Always try to enable FF-A in the kernel. The kernel tries to probe for
FF-A, but only enables it if other components supports it.

Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Brief description of changes:
- Enable Qemu kernel configs for Trusted Keys.
- Add keyutils buildroot package.
- Enable Trusted Keys early TA in OP-TEE.
- Create a new test script (trusted-keys.exp) which is invoked as part
  of "make check" for automated Trusted Keys tests.

Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

Drop ION driver configs from poplar.conf, as since
linaro-swg/linux.git branch optee [1] was rebased onto kernel
v5.12, where ION allocator was removed.

Link: [1] https://github.com/linaro-swg/linux/tree/optee-v5.12-20210628


Acked-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Igor Opaniuk <igor.opaniuk@foundries.io>

Current ZynqMP build script is based on Xilinx Petalinux tool, which
requires the installation of a proprietary tool. The following patch
removes this dependency and gets closed to the common build Makefile
used by other platforms.

The build is done using Xilinx out-of-tree repositories for Linux,
U-Boot and ATF, while using upstream OP-TEE and Buildroot repositories.

Finally the only non standard piece is the usage of pre-compiled
firmware images from the Xilinx wiki page.

Signed-off-by: Ibai Erkiaga <ibai.erkiaga-elorza@xilinx.com>
Acked-by: Jerome Forissier <jerome@forissier.org>

Since Linux commit dcb3b06d9c34 ("tee: optee: replace might_sleep with
cond_resched") in v5.11, setting CONFIG_PREEMPT=y in kconfigs/qemu.conf
is not needed anymore. It was a workaround for the missing call to
cond_resched() in the TEE driver. At that time, might_sleep() together
with preemption enabled allowed to get rid of some RCU warning messages
when running long operations in secure world such as large key generation
(test case: "xtest -l 1 4007_rsa"). With cond_resched() the preemption
settings do not matter anymore.

As a result of this change, QEMUv8 is unmodified (CONFIG_PREEMPT=y is
set by default in the kernel's arch/arm64/configs/defconfig), but 32-bit
QEMU now has CONFIG_PREEMPT disabled. Both platforms are tested and
4007_rsa runs as expected with no warning.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

This patch enables Measured Boot on TF-A and builds the TSS tools
and the TPM Kernel Module for the FVP toolkit.

The functionality is disabled by default. To enable it, build with
MEASURED_BOOT=y.

Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Introduce option XEN_BOOT to add xen in the bootflow.

When built with XEN_BOOT=y, boot flow currently supported is :

BL1 -> BL2 -> BL31 -> OP-TEE -> uboot -> Xen -> Dom0

xtests can be run over Dom0

Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Add an option to build and use U-Boot instead of edk2 as BL33
in the bootflow. To use this option: make UBOOT=y

Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

ION has been deprecated in the upstream Linux kernel since v5.11 [1].
Consequently, it was removed from the linaro-swg/linux branch optee
shortly after the release 3.13.0 of OP-TEE. Remove the corresponding
kernel configuration flags which are now unused.

Link: [1] https://github.com/torvalds/linux/commit/e722a295cf493388dae474745d30e91e1a2ec549


Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

Commit f1ca9916 ("qemu: disable kernel CONFIG_JFFS2_FS") was a
workaround to an issue that does not seem to be reproducible anymore.
That was more than five years ago, and the root cause was never clearly
identified. Many things have changed since.
I did not meet any problem running "make check" with CONFIG_JFFS2_FS=y
on my local development machine (it is enabled by default in the Linux
kernel's arch/arm/configs/qemu_defconfig). Therefore it seems safe to
remove this CONFIG_JFFS2_FS=n.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

Enables the kernel gdb python helper scripts to be built
that allows easier introspection of kernel data structures.
e.g. lx-dmesg extracts dmesg.

Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

Enable SCMI support in the Linux kernel configuration of the
stm32mp1 platform.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Acked-by: Jerome Forissier <jerome@forissier.org>

With 6edcf9dc2e1a ("efi/libstub: EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER
should not default to yes") (included in Linux v5.11) we need to set
EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER=y explicitly in order to enable
initrd support.

Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Adds support for the NXP® i.MX 8MQuad Evaluation Kit (EVK) using the
same standard buildroot setup as for the other platforms here.

The flash-image target (part of the all target) produces a out/boot.img
which can be copied to a SD card using the command:
dd if=out/boot.img of=/dev/sdX bs=1M conv=fsync

Where 'X' has to be adjusted to the device of the SD card when connected
to the host system.

     ****** Please be careful to choose the correct device ******
     ****** or there's a risk of damaging the host system. ******

Acked-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Update U-Boot config fragment to explicitly state no flash or MTD device
is used by U-Boot and the U-Boot environment is not stored outside
U-Boot image. This change is required since U-Boot v2019.01. It
successfully boots Qemu/armv7-A with older and newer U-Boot releases up
to v2020.04, and at least also up to latest U-boot RC tag v2020.07-rc3.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Build OP-TEE for STM32MP1 based platforms. Currently supports platforms
STM32MP157A-DK1, STM32MP157C-DK2 and STM32MP157C-EV1 using a SDcard as
boot media.

Default build targets board STM32MP157C-DK2:
# make

One can specify a target board with PLATFORM configuration switch:
# make PLATFORM=stm32mp1-157A_DK1
# make PLATFORM=stm32mp1-157C_DK2
# make PLATFORM=stm32mp1-157C_EV1

Refer to br-ext/board/stmicroelectronics/stm32mp1-tz/readme.txt for
mode information.

TF-A, OP-TEE OS, U-Boot and Linux kernel are built outside Builrdoot.
All other embedded components are built through Buildroot.
Buildroot generates the final SDcard binary image file to be loaded
raw in the target SD card. The image includes a GPT partition table.
See br-ext/board/stmicroelectronics/stm32mp1-tz/genimage-*.cfg
for more details.

Note on U-Boot defconfig: from v2019.10 up to v2020.07-rc2, one shall
use stm32mp15_optee_defconfig. From v2020-rc3 onward, one shall use
stm32mp15_trusted_defconfig. For flexibility, stm32mp1.mk supports both.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

Provide configuration for ION mem allocator, needed for SDP.

Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>

Adds CONFIG_HW_RANDOM_VIRTIO so the guest gets entropy from the host

Signed-off-by: Albert Schwarzkopf <githubc@quitesimple.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

Adds the required flags and configuration files to enable Wi-Fi on the
HiKey960 board. The network name and password have to be set in
br-ext/board/hikey960/overlay/etc/wpa_supplicant.conf before building.
Then Wi-Fi can be enabled on the board by running 'ifup wlan0' as root.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

Now that our HiKey960 build uses our common Linux branch [1], we no
longer need to force CFG_SECURE_DATA_PATH=n in the main Makefile (the
platform branch we were using previously was lacking the ION unmapped
heap code, which is why SDP had to be disabled).

Let OP-TEE build with the default value for CFG_SECURE_DATA_PATH, which
is 'y' for HiKey960, and configure the Linux kernel accordingly.

[1] https://github.com/linaro-swg/linux

 branch optee. This branch has
been used for the HiKey960 build since OP-TEE 3.4.0, the branch was
based on upstream kernel v4.19.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

ION_DUMMY is an old, deprecated configuration flag in the ION driver
that is now useless. Therefore, remove the useless CONFIG_ION_DUMMY=y.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Suggested-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

With Linux kernel v5.0, CONFIG_SCSI_UFS_HISI is built as a module by
default. We want this driver to be statically linked, or the board
won't boot.

Note: HiKey620 does *not* need a similar fix.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (HiKey 620)

Plain upstream kernel v4.19 now supports HiKey960 well enough, so we do
not need to use the 96boards repository anymore [1]. Setting a few config
symbols is needed however, otherwise the kernel can not boot our
buildroot-generated root FS. This commit introduces the required symbols
so that we can later drop the 96boards branch (when we rebase our optee
branch [2] onto v4.19). Note that having these symbols enabled is OK with
the current branch, too.

Link: [1] https://github.com/96boards-hikey/linux
Link: [2] https://github.com/linaro-swg/linux/tree/optee


Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

1. Switch to upstream ARM Trusted Firmware and U-boot.
2. Change the ATF+OP-TEE booting sequence.

Now the booting sequence looks like:
VideoCore IV bootloader -> ATF + OP-TEE payload -> U-boot -> Linux kernel

Reviewed-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
Signed-off-by: Igor Opaniuk <igor.opaniuk@linaro.org>

Tested-by: Igor Opaniuk <igor.opaniuk@linaro.org>
Reviewed-by: Igor Opaniuk <igor.opaniuk@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

1. Add initial poplar.mk, not integrated with buildroot yet.
2. Configure travis to build poplar setup
3. Add poplar as supported build platform to README.md

Reviewed-by: Victor Chong <victor.chong@linaro.org>
Signed-off-by: Igor Opaniuk <igor.opaniuk@linaro.org>

On the mtk8173 device there is partition which is ~25MB in size and that
area contains both Linux kernel and the root fs. When we stepped up from
Linux kernel 4.9 to 4.12 we got too big to fit in that area and
therefore we have tweaked the config and removed a couple of things not
being used in our setup.

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Follow reference in
https://github.com/96boards/meta-96boards/blob/master/recipes-kernel/linux/linux-hikey_git.bb



do_config() {
	..
	echo 'CONFIG_EXT4_FS=y' >> ${B}/.config
	..
}

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Latest changes in ION requires CONFIG_ION_UNMAPPED_HEAP to configure
the support for unmapped heap.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

Latest changes in ION requires CONFIG_ION_UNMAPPED_HEAP to configure
the support for unmapped heap.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Enable Benchmark feature

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Igor Opaniuk <igor.opaniuk@linaro.org>

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

The first 1Mbyte of the secure RAM is reserved to the ARM-TF on
the qemu ARMv8 setup. To support both QEMU ARMv7 and QEMU ARMv8
with the same kernel configuration that includes a static definition
of the SDP test memory pool, move the SDP pool to the end of the
QEMU secure RAM. SDP pool size is increased to 4MByte.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Enable Linux kernel ION, ION_DUMMY.
Statically define an 3MByte unmapped heap in ION dummy driver. This
complies with the OP-TEE layout for qemu_virt and qemu_armv8 platforms.

CONFIG_ION has dependencies on CONFIG_ANDROID. This changes enables
ION from the Android staging drivers but without enabling other
staged Android features (TIMED_OUTPUT and LOW_MEMORY_KILLER).

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

Add support for configuring QEMU with VirtFS to share data
between the guest QEMU VM and host operating systems.

To specify dir, that has to be mounted inside QEMU VM, edit
QEMU_VIRTFS_HOST_DIR var in qemu.mk

To mount shared folder within QEMU ARM VM, run:
$ mount -t 9p -o trans=virtio host /tmp/shared/

If Virtfs support is enabled, libattr1-dev and libcap-dev
have to be installed before configuring QEMU.

For additional details see:
http://wiki.qemu.org/Documentation/9psetup



Signed-off-by: Igor Opaniuk <igor.opaniuk@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Igor Opaniuk <igor.opaniuk@linaro.org> (qemu_v7/v8)

Besides the rpi3.mk file itself, this also contains the additional
kconfig files and flags used when building Linux and U-Boot.

A set of firmware images are also included.

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: David Brown <david.brown@linaro.org>

It's working, but there is quite a few thing that should be fixed or
just to make it better in general. See this initial commit as a working
start, but slighly experimental. I think this will be easier to deal
with in the future when Linaro builds will include more of this by
default.

List of things that could be better or should be fixed.

- It builds a complete *.deb package for Linux kernel, modules, dtb etc,
  that is convenient, but also takes a lot of time and also it seems
  like it always start by cleaning the builds, which is a little bit
  annoying.

- Each time you launch a new kernel build it will generate completely
  new *.deb files, but with incremented version number. Due to this
  we're using linux-image-*.deb when copy files to the device.

- The UART will probably be hardcoded to UART3 after UEFI, since we're
  using a pre-built boot image.

- We build EDK2 even though we download a pre-build boot image. If we
  sort out which kernel, initrd, dtb etc to put into grub, then we will
  probably not need to download a pre-built boot image and would not
  have the issue with the UART.

- The versioning for the OP-TEE debian package is hardcoded in the
  makefile. It would be good to grab that from git instead for example,
  similar to how we do with the autogenerated h-file.

- This is old, but I've noticed that we only support the 4G version (the
  partition table)

- The URLs to the boot-image and the root fs are hardcoded, eventually
  they will become old an invalid at a point in time.

- There are probably quite a few flags that either doesn't work or
  doesn't make sense when having HiKey / Debian as a target.

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (HiKey 4G)
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>

The line disabling CONFIG_JFFS2_FS was removed by mistake by commit
a6d968c8 ("qemu: generic driver"). Restore it to fix the Travis
tests.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (MT8173-EVB)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>