| Message ID | 20221019092117.5291-1-sven.schultschik@siemens.com (mailing list archive) |
|---|---|
| State | Handled Elsewhere |
| Headers | show |
| Series | [isar-cip-core,1/7] add recipe for optee qemu arm64 | expand |
On 19.10.22 11:21, sven.schultschik@siemens.com wrote: > From: Sven Schultschik <sven.schultschik@siemens.com> > > The recipe provides the possibility to create optee-os binaries for use inside of an qemu secureboot setup with edk2, rpmb, u-boot and uefi > > Signed-off-by: Sven Schultschik <sven.schultschik@siemens.com> > --- > .../op-tee/optee-os-qemu-arm64_3.17.0.bb | 57 +++++++++++++++++++ > recipes-bsp/u-boot/files/secure-boot.cfg.tmpl | 7 +++ > recipes-bsp/u-boot/u-boot-common.inc | 6 +- > 3 files changed, 67 insertions(+), 3 deletions(-) > create mode 100644 recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb > > diff --git a/recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb b/recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb > new file mode 100644 > index 000000000..5e60041af > --- /dev/null > +++ b/recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb > @@ -0,0 +1,57 @@ > +# > +# CIP Core, generic profile > +# > +# Copyright (c) Siemens AG, 2022 > +# > +# Authors: > +# Sven Schultschik <sven.schultschik@siemens.com> > +# > +# SPDX-License-Identifier: MIT > +# > + > +HOMEPAGE = "https://github.com/OP-TEE/optee_os" > +MAINTAINER = "Sven Schultschik <sven.schultschik@siemens.com>" > +LICENSE = "BSD-2-Clause" > + > +require recipes-bsp/optee-os/optee-os-custom.inc > + > +SRC_URI += " \ > + gitsm://github.com/OP-TEE/optee_os.git;branch=master;protocol=https;destsuffix=git;rev=${PV}" Do we really need the second-class supported gitsm fetcher here? Also, destsuffix and rev are both redundant (they are defaults). Oh, indention by 4 spaces would be sufficient. > + > +S = "${WORKDIR}/git" > + > +OPTEE_PLATFORM = "vexpress-qemu_armv8a" > + > +OPTEE_BINARIES = "tee-header_v2.bin \ > + tee-pager_v2.bin \ > + tee-pageable_v2.bin" > + > +DEPENDS = "edk2" > +DEBIAN_BUILD_DEPENDS += " ,\ > + debhelper(>= 11~), \ > + build-essential, \ Redundant. > + cpio, \ > + python3-cryptography, \ > + python3-pycryptodome, \ > + python3-serial, \ > + device-tree-compiler, \ > + edk2, \ Do we need Debian's edk2 here? > + gcc-arm-linux-gnueabihf," > + > +OPTEE_EXTRA_BUILDARGS = "CFG_STMM_PATH=/usr/lib/edk2/BL32_AP_MM.fd CFG_RPMB_FS=y \ > + CFG_RPMB_FS_DEV_ID=0 CFG_CORE_HEAP_SIZE=524288 CFG_RPMB_WRITE_KEY=1 \ > + CFG_CORE_DYN_SHM=y CFG_RPMB_TESTKEY=y \ > + CFG_REE_FS=n\ > + CFG_TEE_CORE_LOG_LEVEL=1 CFG_TEE_TA_LOG_LEVEL=1 CFG_SCTLR_ALIGNMENT_CHECK=n \ > + CFG_ARM64_core=y CFG_CORE_ARM64_PA_BITS=48" > + > +ISAR_CROSS_COMPILE = "0" This looks wrong, specifically as you are installing a 32-bit cross-compiler and calling a 64-bit one as well below. > + > +dpkg_runbuild_prepend() { > + # $(ARCH) is the CPU architecture to be built. > + # Currently, the only supported value is arm for 32-bit or 64-bit Armv7-A or Armv8-A. > + # Please note that contrary to the Linux kernel, $(ARCH) should not be set to arm64 for 64-bit builds. > + export ARCH="arm" > + export CROSS_COMPILE32=arm-linux-gnueabihf- > + export CROSS_COMPILE64=aarch64-linux-gnu- That is a deprecated style, and sbuild will complain. Move into the rules file. > +} > \ No newline at end of file Please have a "newline at the end of file". > diff --git a/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl b/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl > index 956dcbfed..8e6428238 100644 > --- a/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl > +++ b/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl > @@ -4,3 +4,10 @@ CONFIG_USE_BOOTCOMMAND=y > CONFIG_BOOTCOMMAND="setenv scan_dev_for_boot 'if test -e ${devtype} ${devnum}:${distro_bootpart} efi/boot/boot${EFI_ARCH}.efi; then load ${devtype} ${devnum}:${distro_bootpart} ${kernel_addr_r} efi/boot/boot${EFI_ARCH}.efi; bootefi ${kernel_addr_r} ${fdtcontroladdr}; fi'; run distro_bootcmd; echo 'EFI Boot failed!'; sleep 1000; reset" > CONFIG_EFI_VARIABLES_PRESEED=y > CONFIG_EFI_SECURE_BOOT=y > +### OPTEE config > +CONFIG_CMD_OPTEE_RPMB=y > +CONFIG_MMC=y > +CONFIG_SUPPORT_EMMC_RPMB=y > +CONFIG_TEE=y > +CONFIG_OPTEE=y > +CONFIG_EFI_MM_COMM_TEE=y > diff --git a/recipes-bsp/u-boot/u-boot-common.inc b/recipes-bsp/u-boot/u-boot-common.inc > index 60f0da361..7fe4d3fad 100644 > --- a/recipes-bsp/u-boot/u-boot-common.inc > +++ b/recipes-bsp/u-boot/u-boot-common.inc > @@ -25,12 +25,12 @@ DEBIAN_BUILD_DEPENDS += ", libssl-dev:native, libssl-dev:${DISTRO_ARCH}" > > DEBIAN_BUILD_DEPENDS_append_secureboot = ", \ > openssl, pesign, secure-boot-secrets, python3-openssl:native" > -DEPENDS_append_secureboot = " secure-boot-secrets" > +DEPENDS_append_secureboot = " secure-boot-secrets optee-os-${MACHINE}" Nope, this must go into qemu-specific U-Boot bits. We don't have optee-os for the rest yet. > > TEMPLATE_FILES_append_secureboot = " secure-boot.cfg.tmpl" > TEMPLATE_VARS_append_secureboot = " EFI_ARCH" > > do_prepare_build_append_secureboot() { > sed -ni '/### Secure boot config/q;p' ${S}/configs/${U_BOOT_CONFIG} > - cat ${WORKDIR}/secure-boot.cfg >> ${S}/configs/${U_BOOT_CONFIG} > -} > + cat ${WORKDIR}/secure-boot.cfg >> ${S}/configs/${U_BOOT_CONFIG} > +} > \ No newline at end of file Spurious change. Please cross-read your diffs for such things. When you resend, I would suggest to split up the optee recipe introduction and the U-Boot changes. Jan
On 19.10.22 12:44, Jan Kiszka wrote: > On 19.10.22 11:21, sven.schultschik@siemens.com wrote: >> From: Sven Schultschik <sven.schultschik@siemens.com> >> >> The recipe provides the possibility to create optee-os binaries for use inside of an qemu secureboot setup with edk2, rpmb, u-boot and uefi >> >> Signed-off-by: Sven Schultschik <sven.schultschik@siemens.com> >> --- >> .../op-tee/optee-os-qemu-arm64_3.17.0.bb | 57 +++++++++++++++++++ >> recipes-bsp/u-boot/files/secure-boot.cfg.tmpl | 7 +++ >> recipes-bsp/u-boot/u-boot-common.inc | 6 +- >> 3 files changed, 67 insertions(+), 3 deletions(-) >> create mode 100644 recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb >> >> diff --git a/recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb b/recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb >> new file mode 100644 >> index 000000000..5e60041af >> --- /dev/null >> +++ b/recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb >> @@ -0,0 +1,57 @@ >> +# >> +# CIP Core, generic profile >> +# >> +# Copyright (c) Siemens AG, 2022 >> +# >> +# Authors: >> +# Sven Schultschik <sven.schultschik@siemens.com> >> +# >> +# SPDX-License-Identifier: MIT >> +# >> + >> +HOMEPAGE = "https://github.com/OP-TEE/optee_os" >> +MAINTAINER = "Sven Schultschik <sven.schultschik@siemens.com>" >> +LICENSE = "BSD-2-Clause" >> + >> +require recipes-bsp/optee-os/optee-os-custom.inc >> + >> +SRC_URI += " \ >> + gitsm://github.com/OP-TEE/optee_os.git;branch=master;protocol=https;destsuffix=git;rev=${PV}" > > Do we really need the second-class supported gitsm fetcher here? Also, > destsuffix and rev are both redundant (they are defaults). > > Oh, indention by 4 spaces would be sufficient. > >> + >> +S = "${WORKDIR}/git" >> + >> +OPTEE_PLATFORM = "vexpress-qemu_armv8a" >> + >> +OPTEE_BINARIES = "tee-header_v2.bin \ >> + tee-pager_v2.bin \ >> + tee-pageable_v2.bin" >> + >> +DEPENDS = "edk2" >> +DEBIAN_BUILD_DEPENDS += " ,\ >> + debhelper(>= 11~), \ >> + build-essential, \ > > Redundant. > >> + cpio, \ >> + python3-cryptography, \ >> + python3-pycryptodome, \ >> + python3-serial, \ >> + device-tree-compiler, \ >> + edk2, \ > > Do we need Debian's edk2 here? Nope, self-built one -> wrong patch ordering, 2/7 must come first. Jan > >> + gcc-arm-linux-gnueabihf," >> + >> +OPTEE_EXTRA_BUILDARGS = "CFG_STMM_PATH=/usr/lib/edk2/BL32_AP_MM.fd CFG_RPMB_FS=y \ >> + CFG_RPMB_FS_DEV_ID=0 CFG_CORE_HEAP_SIZE=524288 CFG_RPMB_WRITE_KEY=1 \ >> + CFG_CORE_DYN_SHM=y CFG_RPMB_TESTKEY=y \ >> + CFG_REE_FS=n\ >> + CFG_TEE_CORE_LOG_LEVEL=1 CFG_TEE_TA_LOG_LEVEL=1 CFG_SCTLR_ALIGNMENT_CHECK=n \ >> + CFG_ARM64_core=y CFG_CORE_ARM64_PA_BITS=48" >> + >> +ISAR_CROSS_COMPILE = "0" > > This looks wrong, specifically as you are installing a 32-bit > cross-compiler and calling a 64-bit one as well below. > >> + >> +dpkg_runbuild_prepend() { >> + # $(ARCH) is the CPU architecture to be built. >> + # Currently, the only supported value is arm for 32-bit or 64-bit Armv7-A or Armv8-A. >> + # Please note that contrary to the Linux kernel, $(ARCH) should not be set to arm64 for 64-bit builds. >> + export ARCH="arm" >> + export CROSS_COMPILE32=arm-linux-gnueabihf- >> + export CROSS_COMPILE64=aarch64-linux-gnu- > > That is a deprecated style, and sbuild will complain. Move into the > rules file. > >> +} >> \ No newline at end of file > > Please have a "newline at the end of file". > >> diff --git a/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl b/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl >> index 956dcbfed..8e6428238 100644 >> --- a/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl >> +++ b/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl >> @@ -4,3 +4,10 @@ CONFIG_USE_BOOTCOMMAND=y >> CONFIG_BOOTCOMMAND="setenv scan_dev_for_boot 'if test -e ${devtype} ${devnum}:${distro_bootpart} efi/boot/boot${EFI_ARCH}.efi; then load ${devtype} ${devnum}:${distro_bootpart} ${kernel_addr_r} efi/boot/boot${EFI_ARCH}.efi; bootefi ${kernel_addr_r} ${fdtcontroladdr}; fi'; run distro_bootcmd; echo 'EFI Boot failed!'; sleep 1000; reset" >> CONFIG_EFI_VARIABLES_PRESEED=y >> CONFIG_EFI_SECURE_BOOT=y >> +### OPTEE config >> +CONFIG_CMD_OPTEE_RPMB=y >> +CONFIG_MMC=y >> +CONFIG_SUPPORT_EMMC_RPMB=y >> +CONFIG_TEE=y >> +CONFIG_OPTEE=y >> +CONFIG_EFI_MM_COMM_TEE=y >> diff --git a/recipes-bsp/u-boot/u-boot-common.inc b/recipes-bsp/u-boot/u-boot-common.inc >> index 60f0da361..7fe4d3fad 100644 >> --- a/recipes-bsp/u-boot/u-boot-common.inc >> +++ b/recipes-bsp/u-boot/u-boot-common.inc >> @@ -25,12 +25,12 @@ DEBIAN_BUILD_DEPENDS += ", libssl-dev:native, libssl-dev:${DISTRO_ARCH}" >> >> DEBIAN_BUILD_DEPENDS_append_secureboot = ", \ >> openssl, pesign, secure-boot-secrets, python3-openssl:native" >> -DEPENDS_append_secureboot = " secure-boot-secrets" >> +DEPENDS_append_secureboot = " secure-boot-secrets optee-os-${MACHINE}" > > Nope, this must go into qemu-specific U-Boot bits. We don't have > optee-os for the rest yet. > >> >> TEMPLATE_FILES_append_secureboot = " secure-boot.cfg.tmpl" >> TEMPLATE_VARS_append_secureboot = " EFI_ARCH" >> >> do_prepare_build_append_secureboot() { >> sed -ni '/### Secure boot config/q;p' ${S}/configs/${U_BOOT_CONFIG} >> - cat ${WORKDIR}/secure-boot.cfg >> ${S}/configs/${U_BOOT_CONFIG} >> -} >> + cat ${WORKDIR}/secure-boot.cfg >> ${S}/configs/${U_BOOT_CONFIG} >> +} >> \ No newline at end of file > > Spurious change. Please cross-read your diffs for such things. > > When you resend, I would suggest to split up the optee recipe > introduction and the U-Boot changes. > > Jan >
> -----Ursprüngliche Nachricht----- > Von: Kiszka, Jan (T CED) <jan.kiszka@siemens.com> > Gesendet: Mittwoch, 19. Oktober 2022 12:44 > An: Schultschik, Sven (DI PA DCP R&D 2) <sven.schultschik@siemens.com>; cip- > dev@lists.cip-project.org > Betreff: Re: [isar-cip-core][PATCH 1/7] add recipe for optee qemu arm64 > > > + gcc-arm-linux-gnueabihf," > > + > > +OPTEE_EXTRA_BUILDARGS = > "CFG_STMM_PATH=/usr/lib/edk2/BL32_AP_MM.fd CFG_RPMB_FS=y \ > > + CFG_RPMB_FS_DEV_ID=0 CFG_CORE_HEAP_SIZE=524288 > CFG_RPMB_WRITE_KEY=1 \ > > + CFG_CORE_DYN_SHM=y CFG_RPMB_TESTKEY=y \ > > + CFG_REE_FS=n\ > > + CFG_TEE_CORE_LOG_LEVEL=1 CFG_TEE_TA_LOG_LEVEL=1 > CFG_SCTLR_ALIGNMENT_CHECK=n \ > > + CFG_ARM64_core=y CFG_CORE_ARM64_PA_BITS=48" > > + > > +ISAR_CROSS_COMPILE = "0" > > This looks wrong, specifically as you are installing a 32-bit cross-compiler and > calling a 64-bit one as well below. Optee has it's own weired way to cross compile. If you configure optee for arm64 and activate ISAR cross compile it breaks. Just come in my mind. I could delete the exports completly and set isar cross compile to true. So deactivate the Cross compile of optee and use the isar one. I will test if this will work. > > > + > > +dpkg_runbuild_prepend() { > > + # $(ARCH) is the CPU architecture to be built. > > + # Currently, the only supported value is arm for 32-bit or 64-bit Armv7-A or > Armv8-A. > > + # Please note that contrary to the Linux kernel, $(ARCH) should not be set > to arm64 for 64-bit builds. > > + export ARCH="arm" > > + export CROSS_COMPILE32=arm-linux-gnueabihf- > > + export CROSS_COMPILE64=aarch64-linux-gnu- > > That is a deprecated style, and sbuild will complain. Move into the rules file. > Sven
On 19.10.22 15:05, Schultschik, Sven (DI PA DCP R&D 2) wrote: > > >> -----Ursprüngliche Nachricht----- >> Von: Kiszka, Jan (T CED) <jan.kiszka@siemens.com> >> Gesendet: Mittwoch, 19. Oktober 2022 12:44 >> An: Schultschik, Sven (DI PA DCP R&D 2) <sven.schultschik@siemens.com>; cip- >> dev@lists.cip-project.org >> Betreff: Re: [isar-cip-core][PATCH 1/7] add recipe for optee qemu arm64 >> >>> + gcc-arm-linux-gnueabihf," >>> + >>> +OPTEE_EXTRA_BUILDARGS = >> "CFG_STMM_PATH=/usr/lib/edk2/BL32_AP_MM.fd CFG_RPMB_FS=y \ >>> + CFG_RPMB_FS_DEV_ID=0 CFG_CORE_HEAP_SIZE=524288 >> CFG_RPMB_WRITE_KEY=1 \ >>> + CFG_CORE_DYN_SHM=y CFG_RPMB_TESTKEY=y \ >>> + CFG_REE_FS=n\ >>> + CFG_TEE_CORE_LOG_LEVEL=1 CFG_TEE_TA_LOG_LEVEL=1 >> CFG_SCTLR_ALIGNMENT_CHECK=n \ >>> + CFG_ARM64_core=y CFG_CORE_ARM64_PA_BITS=48" >>> + >>> +ISAR_CROSS_COMPILE = "0" >> >> This looks wrong, specifically as you are installing a 32-bit cross-compiler and >> calling a 64-bit one as well below. > > Optee has it's own weired way to cross compile. If you configure optee for arm64 and activate ISAR cross compile it breaks. That is at least not generally true: https://github.com/siemens/meta-iot2050/blob/master/recipes-bsp/optee-os/optee-os-iot2050_3.18.0.bb > > Just come in my mind. I could delete the exports completly and set isar cross compile to true. So deactivate the > Cross compile of optee and use the isar one. I will test if this will work. > Will be curious to see the result. Jan
> -----Ursprüngliche Nachricht----- > Von: Kiszka, Jan (T CED) <jan.kiszka@siemens.com> > Gesendet: Mittwoch, 19. Oktober 2022 12:44 > An: Schultschik, Sven (DI PA DCP R&D 2) <sven.schultschik@siemens.com>; cip- > dev@lists.cip-project.org > Betreff: Re: [isar-cip-core][PATCH 1/7] add recipe for optee qemu arm64 > > On 19.10.22 11:21, sven.schultschik@siemens.com wrote: > > From: Sven Schultschik <sven.schultschik@siemens.com> > > > > The recipe provides the possibility to create optee-os binaries for > > use inside of an qemu secureboot setup with edk2, rpmb, u-boot and > > uefi > > > > Signed-off-by: Sven Schultschik <sven.schultschik@siemens.com> > > --- > > .../op-tee/optee-os-qemu-arm64_3.17.0.bb | 57 +++++++++++++++++++ > > recipes-bsp/u-boot/files/secure-boot.cfg.tmpl | 7 +++ > > recipes-bsp/u-boot/u-boot-common.inc | 6 +- > > 3 files changed, 67 insertions(+), 3 deletions(-) create mode 100644 > > recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb > > > > diff --git a/recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb > > b/recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb > > new file mode 100644 > > index 000000000..5e60041af > > --- /dev/null > > +++ b/recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb > > @@ -0,0 +1,57 @@ > > +# > > +# CIP Core, generic profile > > +# > > +# Copyright (c) Siemens AG, 2022 > > +# > > +# Authors: > > +# Sven Schultschik <sven.schultschik@siemens.com> # # > > +SPDX-License-Identifier: MIT # > > + > > +HOMEPAGE = > "https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.c > om%2FOP- > TEE%2Foptee_os&data=05%7C01%7Csven.schultschik%40siemens.com%7 > C4f98c0d0333a4da5414a08dab1bee02e%7C38ae3bcd95794fd4addab42e1495d > 55a%7C1%7C0%7C638017730602326587%7CUnknown%7CTWFpbGZsb3d8eyJ > WIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C > 3000%7C%7C%7C&sdata=EnwEqlIP690Rw3fcrJv0Wc9dfcAc%2BN8h4O%2B > yRdvsXX4%3D&reserved=0" > > +MAINTAINER = "Sven Schultschik <sven.schultschik@siemens.com>" > > +LICENSE = "BSD-2-Clause" > > + > > +require recipes-bsp/optee-os/optee-os-custom.inc > > + > > +SRC_URI += " \ > > + gitsm://github.com/OP- > TEE/optee_os.git;branch=master;protocol=https;destsuffix=git;rev=${PV}" > > Do we really need the second-class supported gitsm fetcher here? Also, > destsuffix and rev are both redundant (they are defaults). I tried your suggestion and removed destsuffix and rev and now I remember why I added it initially: SRC_URI += " \ git://github.com/OP-TEE/optee_os.git;branch=master;protocol=https" optee-os-qemu-arm64-3.17.0-r0 do_fetch: Fetcher failure for URL: 'git://github.com/OP-TEE/optee_os.git;branch=master;protocol=https'. Please set a valid SRCREV for url ['SRCREV_default_pn-optee-os-qemu-arm64', 'SRCREV_default', 'SRCREV_pn-optee-os-qemu-arm64', 'SRCREV'] (possible key names are git://github.com/OP-TEE/optee_os.git;branch=master;protocol=https, or use a ;rev=X URL parameter)
On 19.10.22 15:21, Schultschik, Sven (DI PA DCP R&D 2) wrote: > > >> -----Ursprüngliche Nachricht----- >> Von: Kiszka, Jan (T CED) <jan.kiszka@siemens.com> >> Gesendet: Mittwoch, 19. Oktober 2022 12:44 >> An: Schultschik, Sven (DI PA DCP R&D 2) <sven.schultschik@siemens.com>; > cip- >> dev@lists.cip-project.org >> Betreff: Re: [isar-cip-core][PATCH 1/7] add recipe for optee qemu arm64 >> >> On 19.10.22 11:21, sven.schultschik@siemens.com wrote: >>> From: Sven Schultschik <sven.schultschik@siemens.com> >>> >>> The recipe provides the possibility to create optee-os binaries for >>> use inside of an qemu secureboot setup with edk2, rpmb, u-boot and >>> uefi >>> >>> Signed-off-by: Sven Schultschik <sven.schultschik@siemens.com> >>> --- >>> .../op-tee/optee-os-qemu-arm64_3.17.0.bb | 57 +++++++++++++++++++ >>> recipes-bsp/u-boot/files/secure-boot.cfg.tmpl | 7 +++ >>> recipes-bsp/u-boot/u-boot-common.inc | 6 +- >>> 3 files changed, 67 insertions(+), 3 deletions(-) create mode 100644 >>> recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb >>> >>> diff --git a/recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb >>> b/recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb >>> new file mode 100644 >>> index 000000000..5e60041af >>> --- /dev/null >>> +++ b/recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb >>> @@ -0,0 +1,57 @@ >>> +# >>> +# CIP Core, generic profile >>> +# >>> +# Copyright (c) Siemens AG, 2022 >>> +# >>> +# Authors: >>> +# Sven Schultschik <sven.schultschik@siemens.com> # # >>> +SPDX-License-Identifier: MIT # >>> + >>> +HOMEPAGE = >> > "https://github.c >> om%2FOP- >> TEE%2Foptee_os&data=05%7C01%7Csven.schultschik%40siemens.com%7 >> C4f98c0d0333a4da5414a08dab1bee02e%7C38ae3bcd95794fd4addab42e1495d >> 55a%7C1%7C0%7C638017730602326587%7CUnknown%7CTWFpbGZsb3d8eyJ >> WIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C >> 3000%7C%7C%7C&sdata=EnwEqlIP690Rw3fcrJv0Wc9dfcAc%2BN8h4O%2B >> yRdvsXX4%3D&reserved=0" >>> +MAINTAINER = "Sven Schultschik <sven.schultschik@siemens.com>" >>> +LICENSE = "BSD-2-Clause" >>> + >>> +require recipes-bsp/optee-os/optee-os-custom.inc >>> + >>> +SRC_URI += " \ >>> + gitsm://github.com/OP- >> TEE/optee_os.git;branch=master;protocol=https;destsuffix=git;rev=${PV}" >> >> Do we really need the second-class supported gitsm fetcher here? Also, >> destsuffix and rev are both redundant (they are defaults). > > I tried your suggestion and removed destsuffix and rev and now I remember > why I added it initially: > > SRC_URI += " \ > git://github.com/OP-TEE/optee_os.git;branch=master;protocol=https" > > optee-os-qemu-arm64-3.17.0-r0 do_fetch: Fetcher failure for URL: > 'git://github.com/OP-TEE/optee_os.git;branch=master;protocol=https'. Please > set a valid SRCREV for url ['SRCREV_default_pn-optee-os-qemu-arm64', > 'SRCREV_default', 'SRCREV_pn-optee-os-qemu-arm64', 'SRCREV'] (possible key > names are git://github.com/OP-TEE/optee_os.git;branch=master;protocol=https, > or use a ;rev=X URL parameter) Right, it gives you an even better suggestion than I what to do /wrt SRCREV when you have multiple repos (not here but in edk2).
diff --git a/recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb b/recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb new file mode 100644 index 000000000..5e60041af --- /dev/null +++ b/recipes-bsp/op-tee/optee-os-qemu-arm64_3.17.0.bb @@ -0,0 +1,57 @@ +# +# CIP Core, generic profile +# +# Copyright (c) Siemens AG, 2022 +# +# Authors: +# Sven Schultschik <sven.schultschik@siemens.com> +# +# SPDX-License-Identifier: MIT +# + +HOMEPAGE = "https://github.com/OP-TEE/optee_os" +MAINTAINER = "Sven Schultschik <sven.schultschik@siemens.com>" +LICENSE = "BSD-2-Clause" + +require recipes-bsp/optee-os/optee-os-custom.inc + +SRC_URI += " \ + gitsm://github.com/OP-TEE/optee_os.git;branch=master;protocol=https;destsuffix=git;rev=${PV}" + +S = "${WORKDIR}/git" + +OPTEE_PLATFORM = "vexpress-qemu_armv8a" + +OPTEE_BINARIES = "tee-header_v2.bin \ + tee-pager_v2.bin \ + tee-pageable_v2.bin" + +DEPENDS = "edk2" +DEBIAN_BUILD_DEPENDS += " ,\ + debhelper(>= 11~), \ + build-essential, \ + cpio, \ + python3-cryptography, \ + python3-pycryptodome, \ + python3-serial, \ + device-tree-compiler, \ + edk2, \ + gcc-arm-linux-gnueabihf," + +OPTEE_EXTRA_BUILDARGS = "CFG_STMM_PATH=/usr/lib/edk2/BL32_AP_MM.fd CFG_RPMB_FS=y \ + CFG_RPMB_FS_DEV_ID=0 CFG_CORE_HEAP_SIZE=524288 CFG_RPMB_WRITE_KEY=1 \ + CFG_CORE_DYN_SHM=y CFG_RPMB_TESTKEY=y \ + CFG_REE_FS=n\ + CFG_TEE_CORE_LOG_LEVEL=1 CFG_TEE_TA_LOG_LEVEL=1 CFG_SCTLR_ALIGNMENT_CHECK=n \ + CFG_ARM64_core=y CFG_CORE_ARM64_PA_BITS=48" + +ISAR_CROSS_COMPILE = "0" + +dpkg_runbuild_prepend() { + # $(ARCH) is the CPU architecture to be built. + # Currently, the only supported value is arm for 32-bit or 64-bit Armv7-A or Armv8-A. + # Please note that contrary to the Linux kernel, $(ARCH) should not be set to arm64 for 64-bit builds. + export ARCH="arm" + export CROSS_COMPILE32=arm-linux-gnueabihf- + export CROSS_COMPILE64=aarch64-linux-gnu- +} \ No newline at end of file diff --git a/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl b/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl index 956dcbfed..8e6428238 100644 --- a/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl +++ b/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl @@ -4,3 +4,10 @@ CONFIG_USE_BOOTCOMMAND=y CONFIG_BOOTCOMMAND="setenv scan_dev_for_boot 'if test -e ${devtype} ${devnum}:${distro_bootpart} efi/boot/boot${EFI_ARCH}.efi; then load ${devtype} ${devnum}:${distro_bootpart} ${kernel_addr_r} efi/boot/boot${EFI_ARCH}.efi; bootefi ${kernel_addr_r} ${fdtcontroladdr}; fi'; run distro_bootcmd; echo 'EFI Boot failed!'; sleep 1000; reset" CONFIG_EFI_VARIABLES_PRESEED=y CONFIG_EFI_SECURE_BOOT=y +### OPTEE config +CONFIG_CMD_OPTEE_RPMB=y +CONFIG_MMC=y +CONFIG_SUPPORT_EMMC_RPMB=y +CONFIG_TEE=y +CONFIG_OPTEE=y +CONFIG_EFI_MM_COMM_TEE=y diff --git a/recipes-bsp/u-boot/u-boot-common.inc b/recipes-bsp/u-boot/u-boot-common.inc index 60f0da361..7fe4d3fad 100644 --- a/recipes-bsp/u-boot/u-boot-common.inc +++ b/recipes-bsp/u-boot/u-boot-common.inc @@ -25,12 +25,12 @@ DEBIAN_BUILD_DEPENDS += ", libssl-dev:native, libssl-dev:${DISTRO_ARCH}" DEBIAN_BUILD_DEPENDS_append_secureboot = ", \ openssl, pesign, secure-boot-secrets, python3-openssl:native" -DEPENDS_append_secureboot = " secure-boot-secrets" +DEPENDS_append_secureboot = " secure-boot-secrets optee-os-${MACHINE}" TEMPLATE_FILES_append_secureboot = " secure-boot.cfg.tmpl" TEMPLATE_VARS_append_secureboot = " EFI_ARCH" do_prepare_build_append_secureboot() { sed -ni '/### Secure boot config/q;p' ${S}/configs/${U_BOOT_CONFIG} - cat ${WORKDIR}/secure-boot.cfg >> ${S}/configs/${U_BOOT_CONFIG} -} + cat ${WORKDIR}/secure-boot.cfg >> ${S}/configs/${U_BOOT_CONFIG} +} \ No newline at end of file