With CFG_TA_TEST_PATH now defaulting to n in optee_client for better
security, this needs to be set explicitly to pass xtest 1008.

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

Fixes a mistake in the optee_os install step which prevents the
libraries from being copied into the root FS staging area.

Fixes: 91ebff72 ("buildroot: add optee_os package to copy shared libraries into the root FS")
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Provide an additional option for CFG_NW_CONSOLE_UART and CFG_SW_CONSOLE_UART
to use the secondary console on the 40-pin Low Speed Connector, namely UART2.

Signed-off-by: Michalis Pappas <mpappas@fastmail.fm>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Signed-off-by: Hashem Tatari <hashem.tatari@exset.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

When the DEBUG config was set, the optee_os was still built with
DEBUG=0 because the flag was hardcoded. As a result the optimization
was still O2. This is fixed by using the global DEBUG flag instead of
the hardcoded value of zero.

Signed-off-by: Hashem Tatari <hashem.tatari@exset.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

This commit adds support for Xilinx ZynqMP boards to the OPTEE/build repository.
The provided makefile relies on Xilinx Petalinux 2018.2 itself based on Yocto.
The makefile helps to create, patch and build a customized Petalinux project
with OPTEE support. Boards can be emulated using Petalinux's QEMU.

Signed-off-by: Michael Grand <michael.grand.mg@gmail.com>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Michael Grand <michael.grand.mg@gmail.com>

When OP-TEE is built with CFG_ULIBS_SHARED=y, TA shared libraries are
created. They have to be installed into the target root FS in order
to be found at runtime.

This patch adds a custom package to do just that.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

With Linux kernel v5.0, CONFIG_SCSI_UFS_HISI is built as a module by
default. We want this driver to be statically linked, or the board
won't boot.

Note: HiKey620 does *not* need a similar fix.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (HiKey 620)

We currently do not copy any kernel module into our root FS, they are
not needed. Therefore, drop the "modules" target when building the
kernel to save compile time.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

All current documentation has been transferred to a new git called
optee_docs [1]. The output from optee_docs will be rendered using Sphinx
and hosted at optee.readthedocs.io [2]. The new documentation git will
also be part of the regular OP-TEE releases. For completeness, it will
also be included in our manifests making up a full OP-TEE developer
setup.

[1] https://github.com/OP-TEE/optee_docs
[2] https://optee.readthedocs.io



Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Update script based on the feedback from Buildroot maintainer [1]:

 > +# /etc/init.d/optee

 Drop this comment, it is useless, and in fact wrong: the file will not
 have this name in a Buildroot filesystem.

 (...)
 > +	if [ -e /usr/sbin/tee-supplicant -a -e /dev/teepriv0 ]; then

 Drop this test, just start tee-supplicatn.

 (...)
 > +		echo "Starting tee-supplicant..."
 > +		/usr/sbin/tee-supplicant &

 Please use start-stop-daemon. See
 https://patchwork.ozlabs.org/patch/994013/ for the "right" way of
 writing an init script.

This maybe not be best way, if there's one, but it seems more
standard to use start-stop-daemon. Moreover the proposed script
ensures its return value matches the status of the caller request.

[1] http://lists.busybox.net/pipermail/buildroot/2018-December/238354.html



Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Targets update_rootfs-common, update_rootfs-clean-common and
filelist-tee-common are not used by any of the supported
platform and their content is not accurate regarding OP-TEE
packages content (init.d.optee, tee-supplicant install path).

This change removes this make targets.

This change also remove the init.d.optee init script which is
no more embedded in the filesystem of the supported platforms.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Fixes: https://github.com/OP-TEE/build/issues/257



Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (RPi3+NFS+JTAG)
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (RPi3, RPi3+NFS)
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (RPi3, RPi3+NFS)
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

For some reason Raspberry Pi 3 with NFS root doesn't allow
tee-supplicant to create a working folder for user 'tee' under the /data
folder. We have found a workaround which is to create the /data
hierarchy and set its permissions in S30optee rather than in the root fs
definition in optee_client.mk.

Fixes: https://github.com/OP-TEE/optee_os/issues/2773



Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (RPi3, RPi3+NFS)
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

To be able to compile uboot.env directly we must have a proper target
instead of the current '$(RPI3_UBOOT_ENV)'. Therefore we replace
'$(RPI3_UBOOT_ENV)' with u-boot-env instead which also lines up better
with the u-boot-env-clean variable.

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (RPi3, RPi3+NFS)
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

The actual configuration in uboot.env.txt has diverged from our
documentation (both the current and coming documentation). The
documentation have "better" names etc, therefore put we put back the
naming of the original configuration.

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (RPi3, RPi3+NFS)
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Add quotes around the soc_term and the port number to make it compatible
with other terminals like terminator.

To use terminator, it is enough to set the flag like:
$ export LAUNCH_TERMINAL="terminator -e"
$ make run-only

Note when using the LAUNCH_TERMINAL the title of the terminals cannot
be set separately so better to ignore the titles

Signed-off-by: Hashem Tatari <hashem.tatari@exset.com>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

In TF-A in the commit:
   (5341b42ec) rpi3: Add mem reserve region to DTB if present

they started to runtime patching of the DTB, but the default build rules
in TF-A doesn't set RPI3_PRELOADED_DTB_BASE to anything which then gets
set to the default value: 1, which gives incorrect memory mappings for
MAP_BL32_MEM. Therefore we must tell where the DTB is located and we do
that by adding adding a compile time flag to TF-A, i.e.,

       RPI3_PRELOADED_DTB_BASE=0x00010000

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (RPi3)
Reviewed-by: Igor Opaniuk <igor.opaniuk@linaro.org>

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Function concatenate_files() used mix of tabs and spaces,
and python3 was very unhappy about this.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Spawn getty for both HDMI and serial console. Leverage
post-build.sh script for rpi3, which adds getty line for
tty1 in inittab [1].

[1]: https://patchwork.ozlabs.org/patch/602668/

Fixes: https://github.com/OP-TEE/build/issues/327


Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Igor Opaniuk <igor.opaniuk@linaro.org>

Qemu and qemu_v8 are almost built the same way. Main differences are
32b/64b modes and u-boot/edk2 as non-secure boot stage.

optee-client targets are removed since now built from the buildroot
target.

This change also ensures on can run 'make run-only' after 'make all'
without rootfs not being copied to the output image directory.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Adds support for Arm Trusted Firmware-A version v2.0.

TF-A v2.0 does not acccept FVP_USE_GIC_DRIVER=FVP_GICV3_LEGACY anymore.
Therefore, use FVP_GICV3 instead. This is the default value with v2.0, and
is also supported by earlier versions (such as 1.5 which is the one we are
using currently).

OP-TEE is configured accordingly (CFG_ARM_GICV3=y).

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Adds support for Arm Trusted Firmware-A version v2.0.

The qemu platform in TF-A v2.0 does not acccept MULTI_CONSOLE=0 anymore,
so remove it. The current version v1.5 is quite happy without it already.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

Use two vCPUs by default instead of one. This configuration is more
likely to trigger race conditions when testing.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Plain upstream kernel v4.19 now supports HiKey960 well enough, so we do
not need to use the 96boards repository anymore [1]. Setting a few config
symbols is needed however, otherwise the kernel can not boot our
buildroot-generated root FS. This commit introduces the required symbols
so that we can later drop the 96boards branch (when we rebase our optee
branch [2] onto v4.19). Note that having these symbols enabled is OK with
the current branch, too.

Link: [1] https://github.com/96boards-hikey/linux
Link: [2] https://github.com/linaro-swg/linux/tree/optee


Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>

common.mk mistakenly uses the QEMU overlay (which currently contains
only an init script for udhcpc) on all platforms. This is incorrect and
causes problems on RPi3 at least [1].

Fixes: commit 751b35bb ("qemu: buildroot: fix networking")
Links: [1] https://github.com/OP-TEE/optee_os/issues/2478#issuecomment-432818199


Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

1. Remove usage of hikey.conf for kernel config
2. Change CFG_DRAM_SIZE_GB to 1
3. Add creation of out directory

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Igor Opaniuk <igor.opaniuk@linaro.org>

Signed-off-by: Igor Opaniuk <igor.opaniuk@linaro.org>

Use Arm's GCC 8.2 toolchains.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Using the current tip of the buildroot upstream branch, we get the
following error:

 build$ make
 [...]
 [...]br-ext/package/optee_benchmark/optee_benchmark.mk:8: *** optee_benchmark has local site method, but `OPTEE_BENCHMARK_SITE` is not defined.  Stop.

The error does not occur if BR2_PACKAGE_OPTEE_BENCHMARK is selected (i.e.,
"make CFG_TEE_BENCHMARK=y").

It looks like the _SITE variable has to be declared even though the
package is not selected for building.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

The Device Tree configuration we need for the Foundation Platform is now
available upstream (v4.18) as foundation-v8-gicv3-psci.dts (it only lacks
the optee node and memory reservations). Let's use this new file instead
of a hacked version of foundation-v8.dts modified for PSCI and GiCv3.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

If /dev/ion exists, it should be set up so that the test user can access
it. Otherwise, some tests will fail, such as xtest 1014 (Secure Data
Path). Similar to what is done for /dev/tee*, this commit configures
permissions based on a specific group: ion.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

1. Switch to upstream ARM Trusted Firmware and U-boot.
2. Change the ATF+OP-TEE booting sequence.

Now the booting sequence looks like:
VideoCore IV bootloader -> ATF + OP-TEE payload -> U-boot -> Linux kernel

Reviewed-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
Signed-off-by: Igor Opaniuk <igor.opaniuk@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>