For some reason Raspberry Pi 3 with NFS root doesn't allow
tee-supplicant to create a working folder for user 'tee' under the /data
folder. We have found a workaround which is to create the /data
hierarchy and set its permissions in S30optee rather than in the root fs
definition in optee_client.mk.

Fixes: https://github.com/OP-TEE/optee_os/issues/2773



Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (RPi3, RPi3+NFS)
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

If /dev/ion exists, it should be set up so that the test user can access
it. Otherwise, some tests will fail, such as xtest 1014 (Secure Data
Path). Similar to what is done for /dev/tee*, this commit configures
permissions based on a specific group: ion.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Restrict execution of TEE client applications to members of the teeclnt
group. A test user is created and added to this group.
Having two groups (tee and teeclnt) allows to better isolate
tee-supplicant from the client applications.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Create user and group tee/tee and set the proper permissions on /dev/tee*
and /data/tee so that tee-supplicant and the client applications may be
run as a non-root user.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Init scripts normally print OK or FAIL when they start daemons. Update
our tee-supplicant script to do just that. The -d option to tee-supplicant
is used so that when the tee-supplicant command returns, we  know for sure
if initialization went well or not.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

Adds external packages repository for buildroot containing:
* Packing for optee_client, optee_examples, optee_test and optee_benchmark
* Configs and a script to assembly defconfigs needed for buildroot

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (QEMU)
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Igor Opaniuk <igor.opaniuk@linaro.org>