WIP: optee-oswip-optee-os-fix

Signed-off-by: Daiane Angolini <daiane.angolini@foundries.io>

6 files changed, 106 insertions, 6 deletions

diff --git a/recipes-security/optee-imx/optee-client-fslc.inc b/recipes-security/optee-imx/optee-client-fslc.inc
index f55f0ab2..e5fe678f 100644
--- a/recipes-security/optee-imx/optee-client-fslc.inc
+++ b/recipes-security/optee-imx/optee-client-fslc.inc
@@ -7,8 +7,8 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=69663ab153298557a59c67a60a743e5b"
 
 SRC_URI = "file://tee-supplicant.service"
 
-S = "${WORKDIR}/git"
-B = "${WORKDIR}/build"
+S = "${UNPACKDIR}/git"
+B = "${UNPACKDIR}/build"
 
 inherit python3native systemd features_check pkgconfig
 
diff --git a/recipes-security/optee-imx/optee-fslc.inc b/recipes-security/optee-imx/optee-fslc.inc
index 6c96dc2b..47f95b0e 100644
--- a/recipes-security/optee-imx/optee-fslc.inc
+++ b/recipes-security/optee-imx/optee-fslc.inc
@@ -6,8 +6,8 @@ REQUIRED_MACHINE_FEATURES = "optee"
 
 DEPENDS = "python3-cryptography-native"
 
-S = "${WORKDIR}/git"
-B = "${WORKDIR}/build"
+S = "${UNPACKDIR}/git"
+B = "${UNPACKDIR}/build"
 
 OPTEE_ARCH:arm     = "arm32"
 OPTEE_ARCH:aarch64 = "arm64"
@@ -23,4 +23,5 @@ EXTRA_OEMAKE = " \
     OPENSSL_MODULES=${STAGING_LIBDIR_NATIVE}/ossl-modules \
     OPTEE_CLIENT_EXPORT=${STAGING_DIR_HOST}${exec_prefix} \
     -C ${S} O=${B} \
+    AFLAGS="${CFLAGS}" \
 "
diff --git a/recipes-security/optee-imx/optee-os-fslc.inc b/recipes-security/optee-imx/optee-os-fslc.inc
index b91a5531..0051130c 100644
--- a/recipes-security/optee-imx/optee-os-fslc.inc
+++ b/recipes-security/optee-imx/optee-os-fslc.inc
@@ -33,6 +33,7 @@ EXTRA_OEMAKE:append:imx8mq-lpddr4-wevk = " \
     CFG_DDR_SIZE=0x100000000 \
     CFG_TZDRAM_START=0xfe000000 \
 "
+export EXTRA_CFLAGS = "${CFLAGS}"
 
 LDFLAGS[unexport] = "1"
 CPPFLAGS[unexport] = "1"
diff --git a/recipes-security/optee-imx/optee-os/0001-checkconf.mk-do-not-use-full-path-to-generate-guard-.patch b/recipes-security/optee-imx/optee-os/0001-checkconf.mk-do-not-use-full-path-to-generate-guard-.patch
new file mode 100644
index 00000000..7a12bff8
--- /dev/null
+++ b/recipes-security/optee-imx/optee-os/0001-checkconf.mk-do-not-use-full-path-to-generate-guard-.patch
@@ -0,0 +1,44 @@
+From c8a2a6529dc3ff609281ef4fe5c5bc949c805b5c Mon Sep 17 00:00:00 2001
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Date: Thu, 6 Jun 2024 11:42:46 +0200
+Subject: [PATCH] checkconf.mk: do not use full path to generate guard symbol
+ in conf.h
+
+The combination of building with -g3 (which emits definitions of all
+defined preprocessor macros to the debug info) and using a full path
+to define the name of this preprocessor guard means that the output is
+not binary reproducible across different build hosts. For example, in
+my Yocto build, the string
+
+  __home_ravi_yocto_tmp_glibc_work_stm32mp135fdk_oe_linux_gnueabi_optee_os_stm32mp_3_19_0_stm32mp_r1_1_build_stm32mp135f_dk_include_generated_conf_h_
+
+appears in several build artifacts. Another developer or buildbot
+would not build in some /home/ravi/... directory.
+
+In order to increase binary reproducibility, only use the path sans
+the $(out-dir)/ prefix of the conf.h file.
+
+Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+---
+ mk/checkconf.mk | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+Upstream-Status: Backport [c8a2a6529dc3ff609281ef4fe5c5bc949c805b5c]
+
+diff --git a/mk/checkconf.mk b/mk/checkconf.mk
+index 449b1c2b8..bb08d6b15 100644
+--- a/mk/checkconf.mk
++++ b/mk/checkconf.mk
+@@ -17,7 +17,8 @@ define check-conf-h
+        cnf='$(strip $(foreach var,                             \
+                $(call cfg-vars-by-prefix,$1),                  \
+                $(call cfg-make-define,$(var))))';              \
+-       guard="_`echo $@ | tr -- -/.+ _`_";                     \
++       guardpath="$(patsubst $(out-dir)/%,%,$@)"               \
++       guard="_`echo "$${guardpath}" | tr -- -/.+ _`_";        \
+        mkdir -p $(dir $@);                                     \
+        echo "#ifndef $${guard}" >$@.tmp;                       \
+        echo "#define $${guard}" >>$@.tmp;                      \
+--
+2.34.1
diff --git a/recipes-security/optee-imx/optee-os/0001-mk-compile.mk-remove-absolute-build-time-paths.patch b/recipes-security/optee-imx/optee-os/0001-mk-compile.mk-remove-absolute-build-time-paths.patch
new file mode 100644
index 00000000..ecea9148
--- /dev/null
+++ b/recipes-security/optee-imx/optee-os/0001-mk-compile.mk-remove-absolute-build-time-paths.patch
@@ -0,0 +1,52 @@
+From 29b84ae5b277b85cd7244acde077694e6643fcde Mon Sep 17 00:00:00 2001
+From: Mikko Rapeli <mikko.rapeli@linaro.org>
+Date: Thu, 18 Jul 2024 07:54:18 +0000
+Subject: [PATCH] mk/compile.mk: remove absolute build time paths
+
+Some generated files get a __FILE_ID__ which include absolute
+build time paths. Remove the paths and use plain file name.
+Fixes yocto QA check.
+
+Problem/bug:
+
+$ strings ../image/lib/firmware/tee.elf | grep mikko
+__FILE_ID__
+_home_mikko_build_core_ta_pub_key_c
+__FILE_ID__
+_home_mikko_build_core_ldelf_hex_c
+__FILE_ID__
+_home_mikko_build_core_early_ta_fd02c9da_306c_48c7_a49c_bbd827ae86ee_c
+
+With this patch:
+
+$ strings ../image/lib/firmware/tee.elf | grep mikko
+$ strings ../image/lib/firmware/tee.elf | grep FILE_ID | egrep \
+"core_ta_pub_key_c|core_ldelf_hex_c|core_early_ta_fd02c9da_306c_4"
+__FILE_ID__ core_ta_pub_key_c
+__FILE_ID__ core_ldelf_hex_c
+__FILE_ID__ core_early_ta_fd02c9da_306c_48c7_a49c_bbd827ae86ee_c
+
+Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
+Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
+Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
+---
+ mk/compile.mk | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Upstream-Status: Backport
+
+diff --git a/mk/compile.mk b/mk/compile.mk
+index b3d807ba4..338535bf3 100644
+--- a/mk/compile.mk
++++ b/mk/compile.mk
+@@ -120,7 +120,7 @@ comp-cppflags-$2 = $$(filter-out $$(CPPFLAGS_REMOVE) $$(cppflags-remove) \
+                      $$(addprefix -I,$$(incdirs-$2)) \
+                      $$(cppflags$$(comp-sm-$2)) \
+                      $$(cppflags-lib$$(comp-lib-$2)) $$(cppflags-$2)) \
+-                     -D__FILE_ID__=$$(subst -,_,$$(subst /,_,$$(subst .,_,$1)))
++                     -D__FILE_ID__=$$(subst -,_,$$(subst /,_,$$(subst .,_,$$(patsubst $$(out-dir)/%,%,$1))))
+
+ comp-flags-$2 += -MD -MF $$(comp-dep-$2) -MT $$@
+ comp-flags-$2 += $$(comp-cppflags-$2)
+--
+2.34.1
diff --git a/recipes-security/optee-imx/optee-os_4.2.0.imx.bb b/recipes-security/optee-imx/optee-os_4.2.0.imx.bb
index 96948bc7..eb9f9171 100644
--- a/recipes-security/optee-imx/optee-os_4.2.0.imx.bb
+++ b/recipes-security/optee-imx/optee-os_4.2.0.imx.bb
@@ -7,6 +7,8 @@ SRC_URI += " \
     file://0002-optee-enable-clang-support.patch \
     file://0003-arm32-libutils-libutee-ta-add-.note.GNU-stack-sectio.patch \
     file://0004-core-link-add-no-warn-rwx-segments.patch \
+    file://0001-checkconf.mk-do-not-use-full-path-to-generate-guard-.patch \
+    file://0001-mk-compile.mk-remove-absolute-build-time-paths.patch \
 "
-SRCBRANCH = "lf-6.6.23_2.0.0"
-SRCREV = "c6be5b572452a2808d1a34588fd10e71715e23cf"
+SRCBRANCH = "lf-6.6.36_2.1.0"
+SRCREV = "612bc5a642a4608d282abeee2349d86de996d7ee"