Fix the following build error:

 $ make GDBSERVER=y
 ...
 Makefile.legacy:9: *** "You have legacy configuration in your .config! Please check your configuration.".  Stop.

The error was introduced by the upgrade to Buildroot 2021.08 [1].

The deprecated option can be found by running "make menuconfig" in
out-br/ and checking the "Legacy options" submenu. It shows that
"gcc 8.x support removed" is selected. We can also see that
BR2_GCC_VERSION_8_X=y appears just below the comment "Legacy options
removed in 2021.08" in out-br/.config. This options comes from file
br-ext/configs/toolchain-br.

Upgrade the toolchain to 10.x which is available in Buildroot 2021.08
and corresponds to the pre-built version we use by default ("make
toolchains" currently downloads 10.2).

Link: https://github.com/OP-TEE/manifest/commit/e8d2210


Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

Following error occurs when running make buildroot QEMU_RUST_ENABLE=y:

$ make buildroot QEMU_RUST_ENABLE=y
...
error: linker  not found
  |
  = note: No such file or directory (os error 2)

error: aborting due to previous error

The toolchains path is not add to the PATH. Fix it.

Signed-off-by: Rong Fan <fanrong03@baidu.com>
Acked-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

When upgrading from Buildroot 2021.2 to 2021.08, the following error
occurs:

 $ make buildroot
 ...
   GEN     /home/jerome/work/optee_repo_qemu_v8/out-br/Makefile

 Your PATH contains spaces, TABs, and/or newline (\n) characters.
 This doesn't work. Fix you PATH.
 make[1]: *** [Makefile:23: _all] Error 2
 make[1]: Leaving directory '/home/jerome/work/optee_repo_qemu_v8/out-br'
 make: *** [common.mk:323: buildroot] Error 2

The space comes from the line that appends the toolchain to the PATH in
optee_rust_examples_ext.mk. Fix it.

Signed-off-by: Jerome Forissier <jerome@forissier.org>

Add OPTEE_RUST_ENABLE option to common.mk and define buildroot packages
for OP-TEE Rust examples
Build Rust examples in optee_rust/examples:
$ cd build && make OPTEE_RUST_ENABLE=y CFG_TEE_RAM_VA_SIZE=0x00300000

Signed-off-by: Rong Fan <fanrong03@baidu.com>
Signed-off-by: Yuan Zhuang <zhuangyuan04@baidu.com>
Acked-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

Fix issue in ftpm_optee_ext/Config.in where BR2_PACKAGE_FTPM_OPTEE_EXT
both selects and depends on BR2_PACKAGE_OPTEE_OS_EXT. Keep only the
select rule.

The issue was found from a OP-TEE build using GCC-11. The build failed
with the following message:

build/br-ext/package/ftpm_optee_ext/Config.in:1:error: recursive dependency detected!
build/br-ext/package/ftpm_optee_ext/Config.in:1:	symbol BR2_PACKAGE_FTPM_OPTEE_EXT depends on BR2_PACKAGE_OPTEE_OS_EXT
build/br-ext/package/optee_os_ext/Config.in:1:	symbol BR2_PACKAGE_OPTEE_OS_EXT is selected by BR2_PACKAGE_FTPM_OPTEE_EXT

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

When VIRTFS_AUTOMOUNT=y and/or PSS_AUTOMOUNT=y, QEMU prints the
following warning:

 qemu-system-aarch64: warning: 9p: degraded performance: a reasonable
 high msize should be chosen on client/guest side (chosen msize is <=
 8192). See https://wiki.qemu.org/Documentation/9psetup#msize

 for
 details.

Let's set the buffer size to 64K mainly to silence this warning. The
performance is noticeably increased too although it doesn't really
matters for typical OP-TEE use cases.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

This patch enables Measured Boot on TF-A and builds the TSS tools
and the TPM Kernel Module for the FVP toolkit.

The functionality is disabled by default. To enable it, build with
MEASURED_BOOT=y.

Signed-off-by: Javier Almansa Sobrino <javier.almansasobrino@arm.com>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Adds a helper script to create a Xen DomU from a Dom0 root shell.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Ruchika Gupta <ruchika.gupta@linaro.org>

Xen tools are required to launch the other DomU's from
Dom0. Enable them in Buildroot. Since Xen is built outside
Buildroot, it is essential to maintain the same version of
Xen built in build system and Xen tools built in Buildroot.

DomU needs a rootfs without the Xen tools. So another target
is introduced to build rootfs for DOMU without Xen tools.

To launch & run DomU:

make XEN_BOOT=y run

From Dom0 prompt:

> cd /mnt/host/qemu_v8/xen
> xl create guest.cfg	# This will create a DomU
To goto DomU's console:
> xl console domu

To run and check xtests from Dom0 and DomU:
make XEN_BOOT=y check

Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Update the toolchain built with the buildroot sdk target used on
non-x86_64 hosts to GCC version 10.2.

Tested-by: Jerome Forissier <jerome@forissier.org> (QEMUv8 64/32, host uname -m: aarch64)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

The needed precompiled toolchains provided by Arm are only available for
x86_64 hosts. For all other host architectures we build it with
Buildroot itself.

Reviewed-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMUv8 64/64, host uname -m: aarch64)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Update the default GCC version to v10.2.

Fixes: https://github.com/OP-TEE/optee_os/issues/4233



Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Acked-by: Jerome Forissier <jerome@forissier.org>

Explicitly set CFG_TEE_BENCHMARK to either ON or OFF upon br-ext
config switch BR2_PACKAGE_OPTEE_BENCHMARK_EXT and not rely on
the default configuration in component CMake files.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

New BR2_PACKAGE_OPTEE_CLIENT_EXT_RPMB_EMU boolean configuration switch
in optee_client_ext package to set RPMB_EMU to ON or OFF in CMake build
of optee_client repository.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

Fix path of the DTB file for ED1 that wrongly pointed to the EV1 DTB
file path.

Fixes: 4dc6908c ("stm32mp1: define STM32MP15C-ED1")
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

STM32MP15C-ED1 is the child board plugged on EV1 mother board. ED1 can
be used without its mother board with some interface restrictions
(I.e. no USB-C). This change defines the platform flavor. The several
components (optee_os, tf-a, u-boot, linux) already support ED1 DTS file
identifier.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Acked-by: Jerome Forissier <jerome@forissier.org>

Change post-image.sh script for stm32Mp1 platform to not try to
copy invalid files are symbolic links to DTB files previously built
in the same build environment. This change makes the script more
flexible.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

Change post-image.sh script for stm32mp1 platform to
dereference the copied files.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

Genimage script configuration had wrong image name on bootfs partition.
Changed the parameter "image" to correct name for the image to be
generated successfully and to allow successful boot on STM32MP157C-EV1
board.

Signed-off-by: Timothée Cercueil <litchi.pi@protonmail.com>
Signed-off-by: Timothée Cercueil <timothee.cercueil@st.com>
Acked-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

Install all TAs found in devkit into target filesystem. This change
allows OP-TEE test environment to exercise in-tree TAs as the pkcs11 TA.

Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

Embed opensc package for pkcs11-tool to play with the PKCS11 TA.

Examples of using pkcs11-tool with PKCS11 TA:

  # Get tokens/slots info
  pkcs11-tool --show-info
  pkcs11-tool --list-token-slots
  pkcs11-tool --list-mechanisms

  # Initialize token and user PIN
  pkcs11-tool --init-token --label test-token --so-pin 1234567890
  pkcs11-tool --label test-token --login --so-pin 1234567890 \
              --init-pin --pin ABCDEFGHIJ

  # Generate a 2048bit RSA key
  pkcs11-tool --token-label test-token --pin ABCDEFGHIJ \
              --keypairgen --key-type RSA:2048 --id 123 --label rsa-test-key

  # List token object
  pkcs11-tool --token-label test-token --list-objects

Co-developed-by: Gábor Székely <szvgabor@gmail.com>
Signed-off-by: Gábor Székely <szvgabor@gmail.com>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Conditionally enable TA C++ tests in the optee_test_ext Buildroot package.
Some toolchains may not support this feature [1] so it is best to let
the user decide.

common.mk enables the tests by default when $(COMPILER) is not clang,
assuming that the default GCC toolchain from toolchain.mk is used (which
works fine with the C++ tests). The command line option is
'make WITH_CXX_TESTS=y|n'.

Link: https://github.com/OP-TEE/optee_test/issues/458


Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Conditionally enable Thread Local Storage tests in the
optee_test_ext Buildroot package. Some toolchains may not support this
feature [1] so it is best to let the user decide.

common.mk enables the tests by default since the GCC toolchain from
toolchain.mk supports them. The command line option is
'make WITH_TLS_TESTS=y|n'.

Link: https://github.com/OP-TEE/optee_test/commit/30efcbeaf8864d0f2a5c4be593a5411001fab31b


Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

By passing GP_PACKAGE=<path to GP-suite archive> optee_test is
configured to compile with the GlobalPlatform test suite. The test suite
is unpacked and patched in the build directory as part of the buildroot
process when building optee_test.

Acked-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Updates the toolchain to Arm's GCC 9.2 [1]. Note the following
difference compared to the previous release (8.3), which is documented
in the release notes:

 "Changed toolchain naming convention to match standard target triplet
  naming convention, with vendor name being none."

For example, arm-linux-gnueabihf-gcc is now arm-none-linux-gnueabihf-gcc
and aarch64-linux-gnu-gcc is now aarch64-none-linux-gnu-gcc.

This renaming seems pretty much specific to the Arm build of GCC, and
the latest Debian and Ubuntu distributions provide GCC 9.x or 10.x
cross-compilers with the usual naming convention.

Therefore, and to limit the impact of the name change, let's simply
create symbolic links after the toolchain packages are extracted.

Link: [1] https://developer.arm.com/tools-and-software/open-source-software/developer-tools/gnu-toolchain/gnu-a/downloads


Signed-off-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Jerome Forissier <jerome@forissier.org> (QEMU, QEMUv8, HiKey, HiKey960)
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (stm32mp1)

The optee_examples_ext and optee_test_ext packages are currently using
the python3 command found in $PATH. It is more correct to use the
Buildroot one.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

Package [host-]python-pycrypto was removed in Buildroot release 2020.05
[1] and replaced with [host-]python3-pycryptodomex.

Link: [1] https://git.busybox.net/buildroot/commit/?id=7ef76ed32fcd447391e26d33a555ff5dab6dc48e


Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

Replace option partition-type with option partition-type-uuid as the
later is intended to GPT partitioning which is what stm32mp1 relies on.
This change prevents genimage tool, since its v13 release, from creating
a hybrid MBR partition table that is not supported by TF-A boot stage
used by the platform.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>

The optee_test TAs are built by a $(wildcard ...) loop. This is
unreliable because there is no guarantee that os_test_lib and
os_test_lib_dl will appear before os_test in the list. Yet os_test
depends on the libraries being built first.

Fix the issue by explicitely listing the libraries and TAs with
dependencies in the correct order, then using a wildcard for the other
TAs.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Usage: set QEMU_PSS_ENABLE=y and adjust QEMU_PSS_HOST_DIR. It also
requires QEMU_VIRTFS_ENABLE to be set to "y".

Also added a buildroot post-script which appends lines to /etc/fstab,
so shared directories can be automatically mounted if
QEMU_VIRTFS_AUTOMOUNT and QEMU_PSS_AUTOMOUNT are set to "y".

Signed-off-by: Roland Nagy <rnagy@xmimx.tk>
Reviewed-by: Jerome Forissier <jerome@forissier.org>
Tested-by: Jerome Forissier <jerome@forissier.org>

Build OP-TEE for STM32MP1 based platforms. Currently supports platforms
STM32MP157A-DK1, STM32MP157C-DK2 and STM32MP157C-EV1 using a SDcard as
boot media.

Default build targets board STM32MP157C-DK2:
# make

One can specify a target board with PLATFORM configuration switch:
# make PLATFORM=stm32mp1-157A_DK1
# make PLATFORM=stm32mp1-157C_DK2
# make PLATFORM=stm32mp1-157C_EV1

Refer to br-ext/board/stmicroelectronics/stm32mp1-tz/readme.txt for
mode information.

TF-A, OP-TEE OS, U-Boot and Linux kernel are built outside Builrdoot.
All other embedded components are built through Buildroot.
Buildroot generates the final SDcard binary image file to be loaded
raw in the target SD card. The image includes a GPT partition table.
See br-ext/board/stmicroelectronics/stm32mp1-tz/genimage-*.cfg
for more details.

Note on U-Boot defconfig: from v2019.10 up to v2020.07-rc2, one shall
use stm32mp15_optee_defconfig. From v2020-rc3 onward, one shall use
stm32mp15_trusted_defconfig. For flexibility, stm32mp1.mk supports both.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

Change packages to default define a _SITE configuration as
expected when _SITE_METHOD is defined. This change aligns
OP-TEE client/examples/test_ext packages with OP-TEE os_ext/benchmark_ext
packages regarding this _SITE_METHOD/_SITE management.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Rename OP-TEE packages in br-ext with a _ext suffix so that
they do not conflict with the OP-TEE packages from Buildroot.

This change essentially renames Buildroot configuration switches
BR2_OPTEE_* to BR2_OPTEE_*_EXT_* without changing the current build
process.

This change is needed for OP-TEE build environment to synchronize with
Buildroot GIT version [1] or later in the Buildroot integration tree.
[1] points where OP-TEE packages were introduced in Buildroot,
right after 2019.02 is released. This was tested with all Buildroot
release tags from 2018.11 to 2020.02, and recent 2020.05-rc1.

Link: [1] https://git.buildroot.net/buildroot/commit/?id=da49312af9e0c3e7f6df50e7d6f77e1fa2921b7a


Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

If an error occurs when building a TA, the error does not stop the
build. It may therefore go unnoticed if files have been generated
previously.

This patch adds "set -e" to address this issue.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Depending on the size of the string in the variable
TARGET_CONFIGURE_OPTS and number of examples, the size of the
string in OPTEE_EXAMPLES_BUILD_TAS produced by evaluation of
the $(foreach...) statement may exceed the maximum length for
execvp() calls from make (128KiB). Delaying the enumeration of
targets by passing a loop-statement for the shell expands the
variables only once and keep the length of the string independent
of the number of examples.

Signed-off-by: Markus S. Wamser <markus.wamser@mixed-mode.de>
Acked-by: Jerome Forissier <jerome@forissier.org>

Depending on the size of the string in the variable
TARGET_CONFIGURE_OPTS and number of tests, the size of the
string in OPTEE_TEST_BUILD_TAS produced by evaluation of
the $(foreach...) statement may exceed the maximum length for
execvp() calls from make (128KiB). Delaying the enumeration of
targets by passing a loop-statement for the shell expands the
variables only once and keep the length of the string independent
of the number of tests.

Signed-off-by: Markus S. Wamser <markus.wamser@mixed-mode.de>
Acked-by: Jerome Forissier <jerome@forissier.org>

Adds the required flags and configuration files to enable Wi-Fi on the
HiKey960 board. The network name and password have to be set in
br-ext/board/hikey960/overlay/etc/wpa_supplicant.conf before building.
Then Wi-Fi can be enabled on the board by running 'ifup wlan0' as root.

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

Fix typo for setting CFG_TEE_BENCHMARK in OPTEE_CLIENT_CONF_OPTS.

Fixes: 93758cc1 ("buildroot: provide CFG_TEE_BENCHMARK in optee_client")
Signed-off-by: Victor Chong <victor.chong@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

The BR2_KERNEL_HEADERS_4_10 has been depracted, so when trying to build
with GDBSERVER=y we got this warning:

  Makefile.legacy:9: *** "You have legacy configuration in your .config!
  Please check your configuration.".  Stop.

To better match recent toolchain updates in this git (gcc updates and
kernel header updates, commit e0298161), we also update buildroot to
use and provide a GCC8.x based toolchain as well as 4.19 kernel headers.

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7)
Acked-by: Jerome Forissier <jerome@forissier.org>

In the GCC v8.2-2018.08 toolchain (previous default in OP-TEE) the
GDB/TUI mode was disabled, which made debugging using GDB slightly more
complicated. However, in more recent versions of GCC like the one
introduced here, i.e., GCC8.3-2019.03, Arm have re-enabled the TUI mode.

But to be able to upgrade the toolchain, one must also step up kernel
headers so that the toolchain matches the kernel headers used by
Buildroot. This means that we are stepping up from 4.18 kernel headers
to 4.19 kernel headers, which seems to be compatible with the version of
GCC that is being introduced in this patch.

Note that after this commit, older GCC versions will not work any
longer when building full OP-TEE developer setups using OP-TEE's
manifest.git and build.git, i.e., trying to run GCC8.2 for example will
give a kernel header mismatch error.

Fixes #334.

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>