summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--conf/machine/include/imx-base.inc12
-rw-r--r--recipes-security/optee-imx/optee-client-fslc-imx.inc35
-rw-r--r--recipes-security/optee-imx/optee-client-fslc.inc59
-rw-r--r--recipes-security/optee-imx/optee-client/tee-supplicant.service11
-rw-r--r--recipes-security/optee-imx/optee-client/tee-supplicant.sh46
-rw-r--r--recipes-security/optee-imx/optee-client/tee-supplicant@.service10
-rw-r--r--recipes-security/optee-imx/optee-client/tee-udev.rules7
-rw-r--r--recipes-security/optee-imx/optee-client_4.2.0.imx.bb7
-rw-r--r--recipes-security/optee-imx/optee-client_4.4.0.imx.bb4
-rw-r--r--recipes-security/optee-imx/optee-fslc.inc50
-rw-r--r--recipes-security/optee-imx/optee-os-common-fslc-imx.inc62
-rw-r--r--recipes-security/optee-imx/optee-os-fslc-imx.inc47
-rw-r--r--recipes-security/optee-imx/optee-os-fslc.inc110
-rw-r--r--recipes-security/optee-imx/optee-os-tadevkit-fslc-imx.inc27
-rw-r--r--recipes-security/optee-imx/optee-os-tadevkit_4.4.0.imx.bb4
-rw-r--r--recipes-security/optee-imx/optee-os/0001-core-Define-section-attributes-for-clang.patch245
-rw-r--r--recipes-security/optee-imx/optee-os/0007-allow-setting-sysroot-for-clang.patch (renamed from recipes-security/optee-imx/optee-os/0002-optee-enable-clang-support.patch)14
-rw-r--r--recipes-security/optee-imx/optee-os_4.2.0.imx.bb10
-rw-r--r--recipes-security/optee-imx/optee-os_4.4.0.imx.bb6
-rw-r--r--recipes-security/optee-imx/optee-test-fslc-imx.inc18
-rw-r--r--recipes-security/optee-imx/optee-test-fslc.inc67
-rw-r--r--recipes-security/optee-imx/optee-test/run-ptest52
-rw-r--r--recipes-security/optee-imx/optee-test_4.2.0.imx.bb10
-rw-r--r--recipes-security/optee-imx/optee-test_4.4.0.imx.bb13
24 files changed, 477 insertions, 449 deletions
diff --git a/conf/machine/include/imx-base.inc b/conf/machine/include/imx-base.inc
index 280d7ca5..52739fef 100644
--- a/conf/machine/include/imx-base.inc
+++ b/conf/machine/include/imx-base.inc
@@ -605,12 +605,12 @@ PREFERRED_VERSION_vulkan-tools:imxvulkan ??= "1.3.275.0.imx"
605PREFERRED_VERSION_vulkan-validation-layers:imxvulkan ??= "1.3.275.0.imx" 605PREFERRED_VERSION_vulkan-validation-layers:imxvulkan ??= "1.3.275.0.imx"
606 606
607# Use i.MX optee Version 607# Use i.MX optee Version
608PREFERRED_VERSION_optee-os:mx8-nxp-bsp ??= "4.2.0.imx" 608PREFERRED_VERSION_optee-os:mx8-nxp-bsp ??= "4.4.0.imx"
609PREFERRED_VERSION_optee-os:mx9-nxp-bsp ??= "4.2.0.imx" 609PREFERRED_VERSION_optee-os:mx9-nxp-bsp ??= "4.4.0.imx"
610PREFERRED_VERSION_optee-client:mx8-nxp-bsp ??= "4.2.0.imx" 610PREFERRED_VERSION_optee-client:mx8-nxp-bsp ??= "4.4.0.imx"
611PREFERRED_VERSION_optee-client:mx9-nxp-bsp ??= "4.2.0.imx" 611PREFERRED_VERSION_optee-client:mx9-nxp-bsp ??= "4.4.0.imx"
612PREFERRED_VERSION_optee-test:mx8-nxp-bsp ??= "4.2.0.imx" 612PREFERRED_VERSION_optee-test:mx8-nxp-bsp ??= "4.4.0.imx"
613PREFERRED_VERSION_optee-test:mx9-nxp-bsp ??= "4.2.0.imx" 613PREFERRED_VERSION_optee-test:mx9-nxp-bsp ??= "4.4.0.imx"
614 614
615# Use i.MX opencv Version 615# Use i.MX opencv Version
616PREFERRED_VERSION_opencv:mx8-nxp-bsp ??= "4.6.0.imx" 616PREFERRED_VERSION_opencv:mx8-nxp-bsp ??= "4.6.0.imx"
diff --git a/recipes-security/optee-imx/optee-client-fslc-imx.inc b/recipes-security/optee-imx/optee-client-fslc-imx.inc
index 60e9e1fa..7aeff9fd 100644
--- a/recipes-security/optee-imx/optee-client-fslc-imx.inc
+++ b/recipes-security/optee-imx/optee-client-fslc-imx.inc
@@ -1,7 +1,36 @@
1# Copyright 2017-2024 NXP 1# Copied from meta-imx/meta-imx-bsp/recipes-security/optee/optee-client-imx.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-scarthgap/imx-6.6.52-2.2.0.xml#L37
2 3
3require optee-client-fslc.inc 4require optee-client-fslc.inc
4 5
5SRC_URI += "git://github.com/nxp-imx/imx-optee-client.git;protocol=https;branch=${SRCBRANCH}" 6DEPENDS += "util-linux-libuuid"
6 7
7COMPATIBLE_MACHINE = "(imx-nxp-bsp)" 8FILESEXTRAPATHS:prepend := "${THISDIR}/optee-client:"
9SRC_URI:remove = "git://github.com/OP-TEE/optee_client.git;branch=master;protocol=https"
10SRC_URI:prepend = "${OPTEE_CLIENT_SRC};branch=${SRCBRANCH} "
11OPTEE_CLIENT_SRC ?= "git://github.com/nxp-imx/imx-optee-client.git;protocol=https"
12
13inherit pkgconfig
14
15EXTRA_OECMAKE += "-DCFG_TEE_CLIENT_LOAD_PATH=${nonarch_base_libdir}"
16
17# Copy the udev rule from the libts recipe for starting tee-supplicant@.service
18SRC_URI += "file://tee-udev.rules"
19# Unix group name for dev/tee* ownership.
20TEE_GROUP_NAME ?= "teeclnt"
21do_install:append () {
22 if ${@oe.utils.conditional('VIRTUAL-RUNTIME_dev_manager', 'busybox-mdev', 'false', 'true', d)}; then
23 install -d ${D}${nonarch_base_libdir}/udev/rules.d/
24 install -m 755 ${UNPACKDIR}/tee-udev.rules ${D}${nonarch_base_libdir}/udev/rules.d/
25 sed -i -e "s/teeclnt/${TEE_GROUP_NAME}/" ${D}${nonarch_base_libdir}/udev/rules.d/tee-udev.rules
26 fi
27
28 if [ "${libdir}" != "${nonarch_base_libdir}" ]; then
29 rm -rf ${D}${libdir}/systemd
30 fi
31}
32inherit ${@oe.utils.conditional('VIRTUAL-RUNTIME_dev_manager', 'busybox-mdev', '', 'useradd', d)}
33USERADD_PACKAGES = "${PN}"
34GROUPADD_PARAM:${PN} = "--system ${TEE_GROUP_NAME}"
35
36FILES:${PN} += "${libdir}/* ${includedir}/*"
diff --git a/recipes-security/optee-imx/optee-client-fslc.inc b/recipes-security/optee-imx/optee-client-fslc.inc
index f55f0ab2..455bdd78 100644
--- a/recipes-security/optee-imx/optee-client-fslc.inc
+++ b/recipes-security/optee-imx/optee-client-fslc.inc
@@ -1,42 +1,43 @@
1# Copyright 2017-2024 NXP 1# Copied from meta-arm/recipes-security/optee/optee-client.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-scarthgap/imx-6.6.52-2.2.0.xml#L30
3
4SUMMARY = "OP-TEE Client API"
5DESCRIPTION = "Open Portable Trusted Execution Environment - Normal World Client side of the TEE"
6HOMEPAGE = "https://www.op-tee.org/"
2 7
3SUMMARY = "OPTEE Client libs"
4HOMEPAGE = "http://www.optee.org/"
5LICENSE = "BSD-2-Clause" 8LICENSE = "BSD-2-Clause"
6LIC_FILES_CHKSUM = "file://LICENSE;md5=69663ab153298557a59c67a60a743e5b" 9LIC_FILES_CHKSUM = "file://LICENSE;md5=69663ab153298557a59c67a60a743e5b"
7 10
8SRC_URI = "file://tee-supplicant.service" 11inherit systemd update-rc.d cmake
9
10S = "${WORKDIR}/git"
11B = "${WORKDIR}/build"
12 12
13inherit python3native systemd features_check pkgconfig 13SRC_URI = " \
14 14 git://github.com/OP-TEE/optee_client.git;branch=master;protocol=https \
15DEPENDS = "util-linux-libuuid" 15 file://tee-supplicant@.service \
16 file://tee-supplicant.sh \
17"
16 18
17REQUIRED_MACHINE_FEATURES = "optee" 19UPSTREAM_CHECK_GITTAGREGEX = "^(?P<pver>\d+(\.\d+)+)$"
18 20
19SYSTEMD_SERVICE:${PN} = "tee-supplicant.service" 21S = "${WORKDIR}/git"
20 22
21EXTRA_OEMAKE = " \ 23EXTRA_OECMAKE = " \
22 -C ${S} O=${B} \ 24 -DBUILD_SHARED_LIBS=ON \
25 -DCFG_TEE_FS_PARENT_PATH='${localstatedir}/lib/tee' \
23" 26"
27EXTRA_OECMAKE:append:toolchain-clang = " -DCFG_WERROR=0"
24 28
25do_install () { 29do_install:append() {
26 oe_runmake -C ${S} install 30 install -D -p -m0644 ${UNPACKDIR}/tee-supplicant@.service ${D}${systemd_system_unitdir}/tee-supplicant@.service
27 31 install -D -p -m0755 ${UNPACKDIR}/tee-supplicant.sh ${D}${sysconfdir}/init.d/tee-supplicant
28 install -D -p -m0644 ${B}/export/usr/lib/libteec.so.2.0.0 ${D}${libdir}/libteec.so.2.0.0
29 ln -sf libteec.so.2.0.0 ${D}${libdir}/libteec.so.2
30 ln -sf libteec.so.2.0.0 ${D}${libdir}/libteec.so
31
32 install -D -p -m0644 ${B}/export/usr/lib/libckteec.so.0.1.0 ${D}${libdir}/libckteec.so.0.1.0
33 ln -sf libckteec.so.0.1.0 ${D}${libdir}/libckteec.so.0
34 ln -sf libckteec.so.0.1.0 ${D}${libdir}/libckteec.so
35 32
36 install -D -p -m0755 ${B}/export/usr/sbin/tee-supplicant ${D}${bindir}/tee-supplicant 33 sed -i -e s:@sysconfdir@:${sysconfdir}:g \
34 -e s:@sbindir@:${sbindir}:g \
35 ${D}${systemd_system_unitdir}/tee-supplicant@.service \
36 ${D}${sysconfdir}/init.d/tee-supplicant
37}
37 38
38 cp -a ${B}/export/usr/include ${D}${includedir} 39SYSTEMD_SERVICE:${PN} = "tee-supplicant@.service"
39 40
40 sed -i -e s:/etc:${sysconfdir}:g -e s:/usr/bin:${bindir}:g ${UNPACKDIR}/tee-supplicant.service 41INITSCRIPT_PACKAGES = "${PN}"
41 install -D -p -m0644 ${UNPACKDIR}/tee-supplicant.service ${D}${systemd_system_unitdir}/tee-supplicant.service 42INITSCRIPT_NAME:${PN} = "tee-supplicant"
42} 43INITSCRIPT_PARAMS:${PN} = "start 10 1 2 3 4 5 . stop 90 0 6 ."
diff --git a/recipes-security/optee-imx/optee-client/tee-supplicant.service b/recipes-security/optee-imx/optee-client/tee-supplicant.service
deleted file mode 100644
index 0e2b4f6b..00000000
--- a/recipes-security/optee-imx/optee-client/tee-supplicant.service
+++ /dev/null
@@ -1,11 +0,0 @@
1[Unit]
2Description=TEE Supplicant
3
4[Service]
5User=root
6EnvironmentFile=-/etc/default/tee-supplicant
7ExecStart=/usr/bin/tee-supplicant $OPTARGS
8
9[Install]
10WantedBy=basic.target
11
diff --git a/recipes-security/optee-imx/optee-client/tee-supplicant.sh b/recipes-security/optee-imx/optee-client/tee-supplicant.sh
new file mode 100644
index 00000000..b4d21950
--- /dev/null
+++ b/recipes-security/optee-imx/optee-client/tee-supplicant.sh
@@ -0,0 +1,46 @@
1#!/bin/sh
2
3# Source function library
4. /etc/init.d/functions
5
6NAME=tee-supplicant
7PATH=/sbin:/bin:/usr/sbin:/usr/bin
8DESC="OP-TEE Supplicant"
9
10DAEMON=@sbindir@/$NAME
11
12test -f $DAEMON || exit 0
13
14test -f @sysconfdir@/default/$NAME && . @sysconfdir@/default/$NAME
15test -f @sysconfdir@/default/rcS && . @sysconfdir@/default/rcS
16
17SSD_OPTIONS="--oknodo --quiet --exec $DAEMON -- -d $OPTARGS"
18
19set -e
20
21case $1 in
22 start)
23 echo -n "Starting $DESC: "
24 start-stop-daemon --start $SSD_OPTIONS
25 echo "${DAEMON##*/}."
26 ;;
27 stop)
28 echo -n "Stopping $DESC: "
29 start-stop-daemon --stop $SSD_OPTIONS
30 echo "${DAEMON##*/}."
31 ;;
32 restart|force-reload)
33 $0 stop
34 sleep 1
35 $0 start
36 ;;
37 status)
38 status ${DAEMON} || exit $?
39 ;;
40 *)
41 echo "Usage: $0 {start|stop|restart|force-reload|status}" >&2
42 exit 1
43 ;;
44esac
45
46exit 0
diff --git a/recipes-security/optee-imx/optee-client/tee-supplicant@.service b/recipes-security/optee-imx/optee-client/tee-supplicant@.service
new file mode 100644
index 00000000..72c0b9aa
--- /dev/null
+++ b/recipes-security/optee-imx/optee-client/tee-supplicant@.service
@@ -0,0 +1,10 @@
1[Unit]
2Description=TEE Supplicant on %i
3
4[Service]
5User=root
6EnvironmentFile=-@sysconfdir@/default/tee-supplicant
7ExecStart=@sbindir@/tee-supplicant $OPTARGS
8
9[Install]
10WantedBy=basic.target
diff --git a/recipes-security/optee-imx/optee-client/tee-udev.rules b/recipes-security/optee-imx/optee-client/tee-udev.rules
new file mode 100644
index 00000000..43fafd8c
--- /dev/null
+++ b/recipes-security/optee-imx/optee-client/tee-udev.rules
@@ -0,0 +1,7 @@
1# tee devices can only be accessed by the teeclnt group members
2KERNEL=="tee[0-9]*", TAG+="systemd", MODE="0660", GROUP="teeclnt"
3
4# If a /dev/teepriv[0-9]* device is detected, start an instance of
5# tee-supplicant.service with the device name as parameter
6KERNEL=="teepriv[0-9]*", MODE="0660", OWNER="root", GROUP="tee", \
7 TAG+="systemd", ENV{SYSTEMD_WANTS}+="tee-supplicant@%k.service"
diff --git a/recipes-security/optee-imx/optee-client_4.2.0.imx.bb b/recipes-security/optee-imx/optee-client_4.2.0.imx.bb
deleted file mode 100644
index 59f8c84d..00000000
--- a/recipes-security/optee-imx/optee-client_4.2.0.imx.bb
+++ /dev/null
@@ -1,7 +0,0 @@
1require optee-client-fslc-imx.inc
2
3SRCBRANCH = "lf-6.6.36_2.1.0"
4SRCREV = "3eac340a781c00ccd61b151b0e9c22a8c6e9f9f0"
5
6DEPENDS += "util-linux"
7EXTRA_OEMAKE += "PKG_CONFIG=pkg-config"
diff --git a/recipes-security/optee-imx/optee-client_4.4.0.imx.bb b/recipes-security/optee-imx/optee-client_4.4.0.imx.bb
new file mode 100644
index 00000000..322f998f
--- /dev/null
+++ b/recipes-security/optee-imx/optee-client_4.4.0.imx.bb
@@ -0,0 +1,4 @@
1require optee-client-fslc-imx.inc
2
3SRCBRANCH = "lf-6.6.52_2.2.0"
4SRCREV = "d221676a58b305bddbf97db00395205b3038de8e"
diff --git a/recipes-security/optee-imx/optee-fslc.inc b/recipes-security/optee-imx/optee-fslc.inc
index 6c96dc2b..6e380e05 100644
--- a/recipes-security/optee-imx/optee-fslc.inc
+++ b/recipes-security/optee-imx/optee-fslc.inc
@@ -1,26 +1,40 @@
1HOMEPAGE = "http://www.optee.org/" 1# Copied from meta-arm/recipes-security/optee/optee.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-scarthgap/imx-6.6.52-2.2.0.xml#L30
2 3
3inherit python3native features_check 4UPSTREAM_CHECK_GITTAGREGEX = "^(?P<pver>\d+(\.\d+)+)$"
4 5
5REQUIRED_MACHINE_FEATURES = "optee" 6COMPATIBLE_MACHINE ?= "invalid"
7COMPATIBLE_MACHINE:qemuarm64 ?= "qemuarm64"
8COMPATIBLE_MACHINE:qemuarm ?= "qemuarm"
9# Please add supported machines below or set it in .bbappend or .conf
6 10
7DEPENDS = "python3-cryptography-native" 11OPTEEMACHINE ?= "${MACHINE}"
12OPTEEMACHINE:aarch64:qemuall ?= "vexpress-qemu_armv8a"
13OPTEEMACHINE:arm:qemuall ?= "vexpress-qemu_virt"
8 14
9S = "${WORKDIR}/git" 15OPTEE_ARCH = "null"
10B = "${WORKDIR}/build" 16OPTEE_ARCH:arm = "arm32"
11
12OPTEE_ARCH:arm = "arm32"
13OPTEE_ARCH:aarch64 = "arm64" 17OPTEE_ARCH:aarch64 = "arm64"
18OPTEE_CORE = "${@d.getVar('OPTEE_ARCH').upper()}"
19
20OPTEE_TOOLCHAIN = "${@d.getVar('TOOLCHAIN') or 'gcc'}"
21OPTEE_COMPILER = "${@bb.utils.contains("BBFILE_COLLECTIONS", "clang-layer", "${OPTEE_TOOLCHAIN}", "gcc", d)}"
14 22
15COMPILER ?= "gcc" 23# Set here but not passed to EXTRA_OEMAKE by default as that breaks
16COMPILER:toolchain-clang = "clang" 24# the optee-os build
25TA_DEV_KIT_DIR = "${STAGING_INCDIR}/optee/export-user_ta"
26
27EXTRA_OEMAKE += "V=1 \
28 LIBGCC_LOCATE_CFLAGS='${HOST_CC_ARCH}${TOOLCHAIN_OPTIONS}' \
29 COMPILER=${OPTEE_COMPILER} \
30 OPTEE_CLIENT_EXPORT=${STAGING_DIR_HOST}${prefix} \
31 TEEC_EXPORT=${STAGING_DIR_HOST}${prefix} \
32 "
33# python3-cryptography needs the legacy provider, so set OPENSSL_MODULES to the
34# right path until this is relocated automatically.
35export OPENSSL_MODULES="${STAGING_LIBDIR_NATIVE}/ossl-modules"
17 36
18CFLAGS += "--sysroot=${STAGING_DIR_HOST}" 37CFLAGS += "--sysroot=${STAGING_DIR_HOST}"
19CXXFLAGS += "--sysroot=${STAGING_DIR_HOST}" 38
20 39# See the rationale in https://github.com/f-secure-foundry/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2021-0001-OP-TEE_TrustZone_bypass.txt.
21EXTRA_OEMAKE = " \ 40CVE_STATUS[CVE-2021-36133] = "disputed: devices shipped open for development purposes"
22 COMPILER=${COMPILER} \
23 OPENSSL_MODULES=${STAGING_LIBDIR_NATIVE}/ossl-modules \
24 OPTEE_CLIENT_EXPORT=${STAGING_DIR_HOST}${exec_prefix} \
25 -C ${S} O=${B} \
26"
diff --git a/recipes-security/optee-imx/optee-os-common-fslc-imx.inc b/recipes-security/optee-imx/optee-os-common-fslc-imx.inc
new file mode 100644
index 00000000..941182fe
--- /dev/null
+++ b/recipes-security/optee-imx/optee-os-common-fslc-imx.inc
@@ -0,0 +1,62 @@
1# Copied from meta-imx/meta-imx-bsp/recipes-security/optee/optee-os-common-imx.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-scarthgap/imx-6.6.52-2.2.0.xml#L37
3
4require optee-os-fslc.inc
5
6DEPENDS:append:arm = "u-boot-mkimage-native"
7
8FILESEXTRAPATHS:prepend := "${THISDIR}/optee-os:"
9
10SRC_URI:remove = "git://github.com/OP-TEE/optee_os.git;branch=master;protocol=https"
11SRC_URI:prepend = "${OPTEE_OS_SRC};branch=${SRCBRANCH} "
12SRC_URI:append = " file://0007-allow-setting-sysroot-for-clang.patch"
13SRC_URI:remove = "file://0001-allow-setting-sysroot-for-libgcc-lookup.patch \
14 file://0002-optee-enable-clang-support.patch \
15 file://0003-core-link-add-no-warn-rwx-segments.patch"
16
17OPTEE_OS_SRC ?= "git://github.com/nxp-imx/imx-optee-os.git;protocol=https"
18
19inherit features_check
20
21REQUIRED_MACHINE_FEATURES = "optee"
22
23OPTEEMACHINE = "imx-${@d.getVar('MACHINE')[1:]}"
24OPTEEMACHINE:imx6qpdlsolox = "imx-mx6qsabresd"
25OPTEEMACHINE:mx6ul-nxp-bsp = "imx-mx6ulevk"
26OPTEEMACHINE:mx6ull-nxp-bsp = "imx-mx6ullevk"
27OPTEEMACHINE:mx6ulz-nxp-bsp = "imx-mx6ulzevk"
28OPTEEMACHINE:mx8mq-nxp-bsp = "imx-mx8mqevk"
29OPTEEMACHINE:mx8mm-nxp-bsp = "imx-mx8mmevk"
30OPTEEMACHINE:mx8mn-nxp-bsp = "imx-mx8mnevk"
31OPTEEMACHINE:mx8mp-nxp-bsp = "imx-mx8mpevk"
32OPTEEMACHINE:mx8mpul-nxp-bsp = "imx-mx8mpevk"
33OPTEEMACHINE:mx8qm-nxp-bsp = "imx-mx8qmmek"
34OPTEEMACHINE:mx8qxp-nxp-bsp = "imx-mx8qxpmek"
35OPTEEMACHINE:mx8dx-nxp-bsp = "imx-mx8dxmek"
36OPTEEMACHINE:mx8dxl-nxp-bsp = "imx-mx8dxlevk"
37OPTEEMACHINE:mx8mnul-nxp-bsp = "imx-mx8mnevk"
38OPTEEMACHINE:mx8ulp-nxp-bsp = "imx-mx8ulpevk"
39OPTEEMACHINE:mx91-nxp-bsp = "imx-mx91evk"
40OPTEEMACHINE:mx93-nxp-bsp = "imx-mx93evk"
41OPTEEMACHINE:mx95-nxp-bsp = "imx-mx95evk"
42
43# Strip the leading imx-
44PLATFORM_FLAVOR = "${@d.getVar('OPTEEMACHINE')[4:]}"
45
46EXTRA_OEMAKE:append = " \
47 CFG_TEE_TA_LOG_LEVEL=0 \
48 CFG_TEE_CORE_LOG_LEVEL=0 \
49"
50
51EXTRA_OEMAKE:append:imx8mq-lpddr4-wevk = " \
52 CFG_CORE_LARGE_PHYS_ADDR=y \
53 CFG_CORE_ARM64_PA_BITS=36 \
54 CFG_DDR_SIZE=0x100000000 \
55 CFG_TZDRAM_START=0xfe000000 \
56"
57
58EXTRA_OEMAKE:append:imx8dxlb0-fips-lpddr4-evk = " \
59 CFG_NXP_CAAM=n \
60"
61
62COMPATIBLE_MACHINE = "(imx-nxp-bsp)"
diff --git a/recipes-security/optee-imx/optee-os-fslc-imx.inc b/recipes-security/optee-imx/optee-os-fslc-imx.inc
index f4a532b7..5fe6a75a 100644
--- a/recipes-security/optee-imx/optee-os-fslc-imx.inc
+++ b/recipes-security/optee-imx/optee-os-fslc-imx.inc
@@ -1,27 +1,26 @@
1require optee-os-fslc.inc 1# Copied from meta-imx/meta-imx-bsp/recipes-security/optee/optee-os-imx.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-scarthgap/imx-6.6.52-2.2.0.xml#L37
2 3
3SRC_URI = "git://github.com/nxp-imx/imx-optee-os.git;protocol=https;branch=${SRCBRANCH}" 4require optee-os-common-fslc-imx.inc
4 5
5# The platform flavor corresponds to the Yocto machine without the leading 'i'. 6do_compile:arm() {
6PLATFORM_FLAVOR = "${@d.getVar('MACHINE')[1:]}" 7 oe_runmake -C ${S} all uTee
7PLATFORM_FLAVOR:imx6qdlsabresd = "mx6qsabresd" 8}
8PLATFORM_FLAVOR:imx6qdlsabreauto = "mx6qsabreauto"
9PLATFORM_FLAVOR:imx6qpdlsolox = "mx6qsabresd"
10PLATFORM_FLAVOR:mx6ul-nxp-bsp = "mx6ulevk"
11PLATFORM_FLAVOR:mx6ull-nxp-bsp = "mx6ullevk"
12PLATFORM_FLAVOR:mx6ulz-nxp-bsp = "mx6ulzevk"
13PLATFORM_FLAVOR:mx8mq-nxp-bsp = "mx8mqevk"
14PLATFORM_FLAVOR:mx8mm-nxp-bsp = "mx8mmevk"
15PLATFORM_FLAVOR:mx8mn-nxp-bsp = "mx8mnevk"
16PLATFORM_FLAVOR:mx8mnul-nxp-bsp = "mx8mnevk"
17PLATFORM_FLAVOR:mx8mp-nxp-bsp = "mx8mpevk"
18PLATFORM_FLAVOR:mx8mpul-nxp-bsp = "mx8mpevk"
19PLATFORM_FLAVOR:mx8qm-nxp-bsp = "mx8qmmek"
20PLATFORM_FLAVOR:mx8qxp-nxp-bsp = "mx8qxpmek"
21PLATFORM_FLAVOR:mx8dx-nxp-bsp = "mx8dxmek"
22PLATFORM_FLAVOR:mx8dxl-nxp-bsp = "mx8dxlevk"
23PLATFORM_FLAVOR:mx8ulp-nxp-bsp = "mx8ulpevk"
24PLATFORM_FLAVOR:mx93-nxp-bsp = "mx93evk"
25PLATFORM_FLAVOR:mx95-nxp-bsp = "mx95evk"
26 9
27COMPATIBLE_MACHINE = "(imx-nxp-bsp)" 10do_install:append () {
11 # Install embedded TAs
12 install -d ${D}${nonarch_base_libdir}/optee_armtz/
13 install -m 444 ${B}/ta/*/*.ta ${D}${nonarch_base_libdir}/optee_armtz/
14}
15
16do_deploy:append() {
17 cp ${B}/core/tee-raw.bin ${DEPLOYDIR}/${MLPREFIX}optee/tee.${PLATFORM_FLAVOR}.bin
18 ln -sf ${MLPREFIX}optee/tee.${PLATFORM_FLAVOR}.bin ${DEPLOYDIR}/tee.bin
19}
20
21do_deploy:append:arm() {
22 cp ${B}/core/uTee ${DEPLOYDIR}/${MLPREFIX}optee/uTee-${OPTEE_BIN_EXT}
23 ln -sf ${MLPREFIX}optee/uTee-${OPTEE_BIN_EXT} ${DEPLOYDIR}/uTee-${OPTEE_BIN_EXT}
24}
25
26FILES:${PN} += "${nonarch_base_libdir}/optee_armtz"
diff --git a/recipes-security/optee-imx/optee-os-fslc.inc b/recipes-security/optee-imx/optee-os-fslc.inc
index 61906344..c1f1f48f 100644
--- a/recipes-security/optee-imx/optee-os-fslc.inc
+++ b/recipes-security/optee-imx/optee-os-fslc.inc
@@ -1,90 +1,86 @@
1# Copyright (C) 2017-2021,2024 NXP 1# Copied from meta-arm/recipes-security/optee/optee-os.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-scarthgap/imx-6.6.52-2.2.0.xml#L30
3
4SUMMARY = "OP-TEE Trusted OS"
5DESCRIPTION = "Open Portable Trusted Execution Environment - Trusted side of the TEE"
6HOMEPAGE = "https://www.op-tee.org/"
2 7
3SUMMARY = "OPTEE OS"
4DESCRIPTION = "OPTEE OS"
5LICENSE = "BSD-2-Clause" 8LICENSE = "BSD-2-Clause"
6LIC_FILES_CHKSUM = "file://LICENSE;md5=c1f21c4f72f372ef38a5a4aee55ec173" 9LIC_FILES_CHKSUM = "file://LICENSE;md5=c1f21c4f72f372ef38a5a4aee55ec173"
7 10
11inherit deploy python3native
8require optee-fslc.inc 12require optee-fslc.inc
9 13
10DEPENDS += "python3-pyelftools-native u-boot-mkimage-native" 14CVE_PRODUCT = "linaro:op-tee op-tee:op-tee_os"
15
16DEPENDS = "python3-pyelftools-native python3-cryptography-native"
17
11DEPENDS:append:toolchain-clang = " compiler-rt" 18DEPENDS:append:toolchain-clang = " compiler-rt"
12 19
13inherit deploy autotools 20SRC_URI = "git://github.com/OP-TEE/optee_os.git;branch=master;protocol=https"
14 21
15# Optee-os can be built for 32 bits and 64 bits at the same time 22S = "${WORKDIR}/git"
16# as long as the compilers are correctly defined. 23B = "${WORKDIR}/build"
17# For 64bits, CROSS_COMPILE64 must be set
18# When defining CROSS_COMPILE and CROSS_COMPILE64, we assure that
19# any 32 or 64 bits builds will pass
20EXTRA_OEMAKE += " \
21 PLATFORM=imx-${PLATFORM_FLAVOR} \
22 CROSS_COMPILE=${HOST_PREFIX} \
23 CROSS_COMPILE64=${HOST_PREFIX} \
24 CFLAGS32=--sysroot=${STAGING_DIR_HOST} \
25 CFLAGS64=--sysroot=${STAGING_DIR_HOST} \
26 CFG_TEE_TA_LOG_LEVEL=0 \
27 CFG_TEE_CORE_LOG_LEVEL=0 \
28"
29 24
30EXTRA_OEMAKE:append:imx8mq-lpddr4-wevk = " \ 25EXTRA_OEMAKE += " \
31 CFG_CORE_LARGE_PHYS_ADDR=y \ 26 PLATFORM=${OPTEEMACHINE} \
32 CFG_CORE_ARM64_PA_BITS=36 \ 27 CFG_${OPTEE_CORE}_core=y \
33 CFG_DDR_SIZE=0x100000000 \ 28 CROSS_COMPILE_core=${HOST_PREFIX} \
34 CFG_TZDRAM_START=0xfe000000 \ 29 CROSS_COMPILE_ta_${OPTEE_ARCH}=${HOST_PREFIX} \
30 NOWERROR=1 \
31 ta-targets=ta_${OPTEE_ARCH} \
32 O=${B} \
35" 33"
34EXTRA_OEMAKE += " HOST_PREFIX=${HOST_PREFIX}"
35EXTRA_OEMAKE += " CROSS_COMPILE64=${HOST_PREFIX}"
36 36
37LDFLAGS[unexport] = "1" 37LDFLAGS[unexport] = "1"
38CPPFLAGS[unexport] = "1" 38CPPFLAGS[unexport] = "1"
39AS[unexport] = "1" 39AS[unexport] = "1"
40LD[unexport] = "1" 40LD[unexport] = "1"
41 41
42do_configure[noexec] = "1"
43
44do_compile:prepend() { 42do_compile:prepend() {
45 PLAT_LIBGCC_PATH=$(${CC} -print-libgcc-file-name) 43 PLAT_LIBGCC_PATH=$(${CC} -print-libgcc-file-name)
46}
47
48do_compile:arm () {
49 oe_runmake all uTee
50} 44}
51 45
52do_compile:aarch64 () { 46do_compile() {
53 oe_runmake all 47 oe_runmake -C ${S} all
54} 48}
55do_compile[cleandirs] = "${B}" 49do_compile[cleandirs] = "${B}"
56 50
57do_deploy () { 51do_install() {
58 install -d ${DEPLOYDIR} 52 #install core in firmware
59 cp ${B}/core/tee-raw.bin ${DEPLOYDIR}/tee.${PLATFORM_FLAVOR}.bin 53 install -d ${D}${nonarch_base_libdir}/firmware/
60 ln -sf tee.${PLATFORM_FLAVOR}.bin ${DEPLOYDIR}/tee.bin 54 install -m 644 ${B}/core/*.bin ${B}/core/tee.elf ${D}${nonarch_base_libdir}/firmware/
61}
62 55
63do_deploy:append:arm () { 56 #install tas in optee_armtz
64 cp ${B}/core/uTee ${DEPLOYDIR}/uTee-${OPTEE_BIN_EXT} 57 install -d ${D}${nonarch_base_libdir}/optee_armtz/
58 install -m 444 ${B}/ta/*/*.ta ${D}${nonarch_base_libdir}/optee_armtz
65} 59}
66 60
67do_install () { 61PACKAGE_ARCH = "${MACHINE_ARCH}"
68 install -d ${D}${nonarch_base_libdir}/firmware/
69 install -m 644 ${B}/core/*.bin ${D}${nonarch_base_libdir}/firmware/
70 62
71 # Install embedded TAs 63do_deploy() {
72 install -d ${D}${nonarch_base_libdir}/optee_armtz/ 64 install -d ${DEPLOYDIR}/${MLPREFIX}optee
73 install -m 444 ${B}/ta/*/*.ta ${D}${nonarch_base_libdir}/optee_armtz/ 65 install -m 644 ${D}${nonarch_base_libdir}/firmware/* ${DEPLOYDIR}/${MLPREFIX}optee
74 66
75 # Install the TA devkit 67 install -d ${DEPLOYDIR}/${MLPREFIX}optee/ta
76 install -d ${D}${includedir}/optee/export-user_ta_${OPTEE_ARCH}/ 68 install -m 644 ${B}/ta/*/*.elf ${DEPLOYDIR}/${MLPREFIX}optee/ta
77 cp -aR ${B}/export-ta_${OPTEE_ARCH}/* \
78 ${D}${includedir}/optee/export-user_ta_${OPTEE_ARCH}/
79} 69}
80 70
81addtask deploy after do_compile before do_install 71addtask deploy before do_build after do_install
82 72
83FILES:${PN} = "${nonarch_base_libdir}/firmware/ ${nonarch_base_libdir}/optee_armtz/" 73SYSROOT_DIRS += "${nonarch_base_libdir}/firmware"
84FILES:${PN}-staticdev = "${includedir}/optee/"
85RDEPENDS:${PN}-dev += "${PN}-staticdev"
86 74
87# FIXME: Build paths are currently embedded 75PACKAGES += "${PN}-ta"
88INSANE_SKIP:${PN}-staticdev += "buildpaths" 76FILES:${PN} = "${nonarch_base_libdir}/firmware/"
77FILES:${PN}-ta = "${nonarch_base_libdir}/optee_armtz/*"
78
79
80# note: "textrel" is not triggered on all archs
81INSANE_SKIP:${PN} = "textrel"
82# Build paths are currently embedded
83INSANE_SKIP:${PN} += "buildpaths"
84INSANE_SKIP:${PN}-dev = "staticdev"
85INHIBIT_PACKAGE_STRIP = "1"
89 86
90PACKAGE_ARCH = "${MACHINE_ARCH}"
diff --git a/recipes-security/optee-imx/optee-os-tadevkit-fslc-imx.inc b/recipes-security/optee-imx/optee-os-tadevkit-fslc-imx.inc
new file mode 100644
index 00000000..18cf9a37
--- /dev/null
+++ b/recipes-security/optee-imx/optee-os-tadevkit-fslc-imx.inc
@@ -0,0 +1,27 @@
1# Copied from meta-imx/meta-imx-bsp/recipes-security/optee/optee-os-tadevkit-imx.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-scarthgap/imx-6.6.52-2.2.0.xml#L37
3
4require optee-os-common-fslc-imx.inc
5
6SUMMARY = "OP-TEE Trusted OS TA devkit"
7DESCRIPTION = "OP-TEE TA devkit for build TAs"
8HOMEPAGE = "https://www.op-tee.org/"
9
10DEPENDS += "python3-pycryptodome-native"
11
12do_install() {
13 #install TA devkit
14 install -d ${D}${includedir}/optee/export-user_ta/
15 for f in ${B}/export-ta_${OPTEE_ARCH}/* ; do
16 cp -aR $f ${D}${includedir}/optee/export-user_ta/
17 done
18}
19
20do_deploy() {
21 echo "Do not inherit do_deploy from optee-os."
22}
23
24FILES:${PN} = "${includedir}/optee/"
25
26# Build paths are currently embedded
27INSANE_SKIP:${PN}-dev += "buildpaths"
diff --git a/recipes-security/optee-imx/optee-os-tadevkit_4.4.0.imx.bb b/recipes-security/optee-imx/optee-os-tadevkit_4.4.0.imx.bb
new file mode 100644
index 00000000..bb2e2cf6
--- /dev/null
+++ b/recipes-security/optee-imx/optee-os-tadevkit_4.4.0.imx.bb
@@ -0,0 +1,4 @@
1require optee-os-tadevkit-fslc-imx.inc
2
3SRCBRANCH = "lf-6.6.52_2.2.0"
4SRCREV = "60beb308810f9561a67fdb435388a64c85eb6dcb"
diff --git a/recipes-security/optee-imx/optee-os/0001-core-Define-section-attributes-for-clang.patch b/recipes-security/optee-imx/optee-os/0001-core-Define-section-attributes-for-clang.patch
deleted file mode 100644
index 54fbe541..00000000
--- a/recipes-security/optee-imx/optee-os/0001-core-Define-section-attributes-for-clang.patch
+++ /dev/null
@@ -1,245 +0,0 @@
1From ef83625c9a5f50610e25aa860c4b9c5e64723a66 Mon Sep 17 00:00:00 2001
2From: Emekcan Aras <emekcan.aras@arm.com>
3Date: Wed, 21 Dec 2022 10:55:58 +0000
4Subject: [PATCH 1/4] core: Define section attributes for clang
5
6Clang's attribute section is not same as gcc, here we need to add flags
7to sections so they can be eventually collected by linker into final
8output segments. Only way to do so with clang is to use
9
10pragma clang section ...
11
12The behavious is described here [1], this allows us to define names bss
13sections. This was not an issue until clang-15 where LLD linker starts
14to detect the section flags before merging them and throws the following
15errors
16
17| ld.lld: error: section type mismatch for .nozi.kdata_page
18| >>> /mnt/b/yoe/master/build/tmp/work/qemuarm64-yoe-linux/optee-os-tadevkit/3.17.0-r0/build/core/arch/arm/kernel/thread.o:(.nozi.kdata_page): SHT_PROGBITS
19| >>> output section .nozi: SHT_NOBITS
20|
21| ld.lld: error: section type mismatch for .nozi.mmu.l2
22| >>> /mnt/b/yoe/master/build/tmp/work/qemuarm64-yoe-linux/optee-os-tadevkit/3.17.0-r0/build/core/arch/arm/mm/core_mmu_lpae.o:(.nozi.mmu.l2): SHT_PROGBITS
23| >>> output section .nozi: SHT_NOBITS
24
25These sections should be carrying SHT_NOBITS but so far it was not
26possible to do so, this patch tries to use clangs pragma to get this
27going and match the functionality with gcc.
28
29[1] https://intel.github.io/llvm-docs/clang/LanguageExtensions.html#specifying-section-names-for-global-objects-pragma-clang-section
30
31Upstream-Status: Pending
32Signed-off-by: Khem Raj <raj.khem@gmail.com>
33Signed-off-by: Oleksandr Suvorov <oleksandr.suvorov@foundries.io>
34---
35
36 core/arch/arm/kernel/thread.c | 19 +++++++++++++++--
37 core/arch/arm/mm/core_mmu_lpae.c | 35 +++++++++++++++++++++++++++----
38 core/arch/arm/mm/core_mmu_v7.c | 36 +++++++++++++++++++++++++++++---
39 core/kernel/thread.c | 13 +++++++++++-
40 core/mm/pgt_cache.c | 12 ++++++++++-
41 5 files changed, 104 insertions(+), 11 deletions(-)
42
43diff --git a/core/arch/arm/kernel/thread.c b/core/arch/arm/kernel/thread.c
44index 66833b3a0..b3eb9cf9a 100644
45--- a/core/arch/arm/kernel/thread.c
46+++ b/core/arch/arm/kernel/thread.c
47@@ -45,15 +45,30 @@ static size_t thread_user_kcode_size __nex_bss;
48 #if defined(CFG_CORE_UNMAP_CORE_AT_EL0) && \
49 defined(CFG_CORE_WORKAROUND_SPECTRE_BP_SEC) && defined(ARM64)
50 long thread_user_kdata_sp_offset __nex_bss;
51+#ifdef __clang__
52+#ifndef CFG_VIRTUALIZATION
53+#pragma clang section bss=".nozi.kdata_page"
54+#else
55+#pragma clang section bss=".nex_nozi.kdata_page"
56+#endif
57+#endif
58 static uint8_t thread_user_kdata_page[
59 ROUNDUP(sizeof(struct thread_core_local) * CFG_TEE_CORE_NB_CORE,
60 SMALL_PAGE_SIZE)]
61 __aligned(SMALL_PAGE_SIZE)
62+#ifndef __clang__
63 #ifndef CFG_NS_VIRTUALIZATION
64- __section(".nozi.kdata_page");
65+ __section(".nozi.kdata_page")
66 #else
67- __section(".nex_nozi.kdata_page");
68+ __section(".nex_nozi.kdata_page")
69 #endif
70+#endif
71+ ;
72+#endif
73+
74+/* reset BSS section to default ( .bss ) */
75+#ifdef __clang__
76+#pragma clang section bss=""
77 #endif
78
79 #ifdef ARM32
80diff --git a/core/arch/arm/mm/core_mmu_lpae.c b/core/arch/arm/mm/core_mmu_lpae.c
81index 4c8b85e39..1885e1d3f 100644
82--- a/core/arch/arm/mm/core_mmu_lpae.c
83+++ b/core/arch/arm/mm/core_mmu_lpae.c
84@@ -234,19 +234,46 @@ typedef uint16_t l1_idx_t;
85 typedef uint64_t base_xlat_tbls_t[CFG_TEE_CORE_NB_CORE][NUM_BASE_LEVEL_ENTRIES];
86 typedef uint64_t xlat_tbl_t[XLAT_TABLE_ENTRIES];
87
88+#ifdef __clang__
89+#pragma clang section bss=".nozi.mmu.base_table"
90+#endif
91 static base_xlat_tbls_t base_xlation_table[NUM_BASE_TABLES]
92 __aligned(NUM_BASE_LEVEL_ENTRIES * XLAT_ENTRY_SIZE)
93- __section(".nozi.mmu.base_table");
94+#ifndef __clang__
95+ __section(".nozi.mmu.base_table")
96+#endif
97+;
98+#ifdef __clang__
99+#pragma clang section bss=""
100+#endif
101
102+#ifdef __clang__
103+#pragma clang section bss=".nozi.mmu.l2"
104+#endif
105 static xlat_tbl_t xlat_tables[MAX_XLAT_TABLES]
106- __aligned(XLAT_TABLE_SIZE) __section(".nozi.mmu.l2");
107+ __aligned(XLAT_TABLE_SIZE)
108+#ifndef __clang__
109+ __section(".nozi.mmu.l2")
110+#endif
111+;
112+#ifdef __clang__
113+#pragma clang section bss=""
114+#endif
115
116 #define XLAT_TABLES_SIZE (sizeof(xlat_tbl_t) * MAX_XLAT_TABLES)
117
118+#ifdef __clang__
119+#pragma clang section bss=".nozi.mmu.l2"
120+#endif
121 /* MMU L2 table for TAs, one for each thread */
122 static xlat_tbl_t xlat_tables_ul1[CFG_NUM_THREADS]
123- __aligned(XLAT_TABLE_SIZE) __section(".nozi.mmu.l2");
124-
125+#ifndef __clang__
126+ __aligned(XLAT_TABLE_SIZE) __section(".nozi.mmu.l2")
127+#endif
128+;
129+#ifdef __clang__
130+#pragma clang section bss=""
131+#endif
132 /*
133 * TAs page table entry inside a level 1 page table.
134 *
135diff --git a/core/arch/arm/mm/core_mmu_v7.c b/core/arch/arm/mm/core_mmu_v7.c
136index 61e703da8..1960c08ca 100644
137--- a/core/arch/arm/mm/core_mmu_v7.c
138+++ b/core/arch/arm/mm/core_mmu_v7.c
139@@ -204,16 +204,46 @@ typedef uint32_t l1_xlat_tbl_t[NUM_L1_ENTRIES];
140 typedef uint32_t l2_xlat_tbl_t[NUM_L2_ENTRIES];
141 typedef uint32_t ul1_xlat_tbl_t[NUM_UL1_ENTRIES];
142
143+#ifdef __clang__
144+#pragma clang section bss=".nozi.mmu.l1"
145+#endif
146 static l1_xlat_tbl_t main_mmu_l1_ttb
147- __aligned(L1_ALIGNMENT) __section(".nozi.mmu.l1");
148+ __aligned(L1_ALIGNMENT)
149+#ifndef __clang__
150+ __section(".nozi.mmu.l1")
151+#endif
152+;
153+#ifdef __clang__
154+#pragma clang section bss=""
155+#endif
156
157 /* L2 MMU tables */
158+#ifdef __clang__
159+#pragma clang section bss=".nozi.mmu.l2"
160+#endif
161 static l2_xlat_tbl_t main_mmu_l2_ttb[MAX_XLAT_TABLES]
162- __aligned(L2_ALIGNMENT) __section(".nozi.mmu.l2");
163+ __aligned(L2_ALIGNMENT)
164+#ifndef __clang__
165+ __section(".nozi.mmu.l2")
166+#endif
167+;
168+#ifdef __clang__
169+#pragma clang section bss=""
170+#endif
171
172 /* MMU L1 table for TAs, one for each thread */
173+#ifdef __clang__
174+#pragma clang section bss=".nozi.mmu.ul1"
175+#endif
176 static ul1_xlat_tbl_t main_mmu_ul1_ttb[CFG_NUM_THREADS]
177- __aligned(UL1_ALIGNMENT) __section(".nozi.mmu.ul1");
178+ __aligned(UL1_ALIGNMENT)
179+#ifndef __clang__
180+ __section(".nozi.mmu.ul1")
181+#endif
182+;
183+#ifdef __clang__
184+#pragma clang section bss=""
185+#endif
186
187 struct mmu_partition {
188 l1_xlat_tbl_t *l1_table;
189diff --git a/core/kernel/thread.c b/core/kernel/thread.c
190index 2a1f22dce..5516b6771 100644
191--- a/core/kernel/thread.c
192+++ b/core/kernel/thread.c
193@@ -39,13 +39,24 @@ static uint32_t end_canary_value = 0xababab00;
194 name[stack_num][sizeof(name[stack_num]) / sizeof(uint32_t) - 1]
195 #endif
196
197+#define DO_PRAGMA(x) _Pragma (#x)
198+
199+#ifdef __clang__
200+#define DECLARE_STACK(name, num_stacks, stack_size, linkage) \
201+DO_PRAGMA (clang section bss=".nozi_stack." #name) \
202+linkage uint32_t name[num_stacks] \
203+ [ROUNDUP(stack_size + STACK_CANARY_SIZE + STACK_CHECK_EXTRA, \
204+ STACK_ALIGNMENT) / sizeof(uint32_t)] \
205+ __attribute__((aligned(STACK_ALIGNMENT))); \
206+DO_PRAGMA(clang section bss="")
207+#else
208 #define DECLARE_STACK(name, num_stacks, stack_size, linkage) \
209 linkage uint32_t name[num_stacks] \
210 [ROUNDUP(stack_size + STACK_CANARY_SIZE + STACK_CHECK_EXTRA, \
211 STACK_ALIGNMENT) / sizeof(uint32_t)] \
212 __attribute__((section(".nozi_stack." # name), \
213 aligned(STACK_ALIGNMENT)))
214-
215+#endif
216 #define GET_STACK(stack) ((vaddr_t)(stack) + STACK_SIZE(stack))
217
218 DECLARE_STACK(stack_tmp, CFG_TEE_CORE_NB_CORE, STACK_TMP_SIZE,
219diff --git a/core/mm/pgt_cache.c b/core/mm/pgt_cache.c
220index 79553c6d2..b9efdf427 100644
221--- a/core/mm/pgt_cache.c
222+++ b/core/mm/pgt_cache.c
223@@ -410,8 +410,18 @@ void pgt_init(void)
224 * has a large alignment, while .bss has a small alignment. The current
225 * link script is optimized for small alignment in .bss
226 */
227+#ifdef __clang__
228+#pragma clang section bss=".nozi.mmu.l2"
229+#endif
230 static uint8_t pgt_tables[PGT_CACHE_SIZE][PGT_SIZE]
231- __aligned(PGT_SIZE) __section(".nozi.pgt_cache");
232+ __aligned(PGT_SIZE)
233+#ifndef __clang__
234+ __section(".nozi.pgt_cache")
235+#endif
236+ ;
237+#ifdef __clang__
238+#pragma clang section bss=""
239+#endif
240 size_t n;
241
242 for (n = 0; n < ARRAY_SIZE(pgt_tables); n++) {
243--
2442.43.2
245
diff --git a/recipes-security/optee-imx/optee-os/0002-optee-enable-clang-support.patch b/recipes-security/optee-imx/optee-os/0007-allow-setting-sysroot-for-clang.patch
index dbc53542..067ba6eb 100644
--- a/recipes-security/optee-imx/optee-os/0002-optee-enable-clang-support.patch
+++ b/recipes-security/optee-imx/optee-os/0007-allow-setting-sysroot-for-clang.patch
@@ -1,7 +1,7 @@
1From 2ba573c9763329fbfdfacc8393d565ab747cac4d Mon Sep 17 00:00:00 2001 1From db9e44af75c7cfd3316cab15aaa387383df3e57e Mon Sep 17 00:00:00 2001
2From: Brett Warren <brett.warren@arm.com> 2From: Brett Warren <brett.warren@arm.com>
3Date: Wed, 23 Sep 2020 09:27:34 +0100 3Date: Wed, 23 Sep 2020 09:27:34 +0100
4Subject: [PATCH 2/4] optee: enable clang support 4Subject: [PATCH] optee: enable clang support
5 5
6When compiling with clang, the LIBGCC_LOCATE_CFLAG variable used 6When compiling with clang, the LIBGCC_LOCATE_CFLAG variable used
7to provide a sysroot wasn't included, which results in not locating 7to provide a sysroot wasn't included, which results in not locating
@@ -10,17 +10,16 @@ compiler-rt. This is mitigated by including the variable as ammended.
10Upstream-Status: Pending 10Upstream-Status: Pending
11ChangeId: 8ba69a4b2eb8ebaa047cb266c9aa6c2c3da45701 11ChangeId: 8ba69a4b2eb8ebaa047cb266c9aa6c2c3da45701
12Signed-off-by: Brett Warren <brett.warren@arm.com> 12Signed-off-by: Brett Warren <brett.warren@arm.com>
13Signed-off-by: Oleksandr Suvorov <oleksandr.suvorov@foundries.io>
14---
15 13
14---
16 mk/clang.mk | 2 +- 15 mk/clang.mk | 2 +-
17 1 file changed, 1 insertion(+), 1 deletion(-) 16 1 file changed, 1 insertion(+), 1 deletion(-)
18 17
19diff --git a/mk/clang.mk b/mk/clang.mk 18diff --git a/mk/clang.mk b/mk/clang.mk
20index a045beee8..1ebe2f702 100644 19index c141a3f2..7d067cc0 100644
21--- a/mk/clang.mk 20--- a/mk/clang.mk
22+++ b/mk/clang.mk 21+++ b/mk/clang.mk
23@@ -30,7 +30,7 @@ comp-cflags-warns-clang := -Wno-language-extension-token \ 22@@ -27,7 +27,7 @@ comp-cflags-warns-clang := -Wno-language-extension-token \
24 23
25 # Note, use the compiler runtime library (libclang_rt.builtins.*.a) instead of 24 # Note, use the compiler runtime library (libclang_rt.builtins.*.a) instead of
26 # libgcc for clang 25 # libgcc for clang
@@ -29,6 +28,3 @@ index a045beee8..1ebe2f702 100644
29 -rtlib=compiler-rt -print-libgcc-file-name 2> /dev/null) 28 -rtlib=compiler-rt -print-libgcc-file-name 2> /dev/null)
30 29
31 # Core ASLR relies on the executable being ready to run from its preferred load 30 # Core ASLR relies on the executable being ready to run from its preferred load
32--
332.43.2
34
diff --git a/recipes-security/optee-imx/optee-os_4.2.0.imx.bb b/recipes-security/optee-imx/optee-os_4.2.0.imx.bb
deleted file mode 100644
index 11da204e..00000000
--- a/recipes-security/optee-imx/optee-os_4.2.0.imx.bb
+++ /dev/null
@@ -1,10 +0,0 @@
1# Copyright 2017-2024 NXP
2
3require optee-os-fslc-imx.inc
4
5SRC_URI += " \
6 file://0001-core-Define-section-attributes-for-clang.patch \
7 file://0002-optee-enable-clang-support.patch \
8"
9SRCBRANCH = "lf-6.6.36_2.1.0"
10SRCREV = "612bc5a642a4608d282abeee2349d86de996d7ee"
diff --git a/recipes-security/optee-imx/optee-os_4.4.0.imx.bb b/recipes-security/optee-imx/optee-os_4.4.0.imx.bb
new file mode 100644
index 00000000..dc6d3901
--- /dev/null
+++ b/recipes-security/optee-imx/optee-os_4.4.0.imx.bb
@@ -0,0 +1,6 @@
1# Copyright 2017-2024 NXP
2
3require optee-os-fslc-imx.inc
4
5SRCBRANCH = "lf-6.6.52_2.2.0"
6SRCREV = "60beb308810f9561a67fdb435388a64c85eb6dcb"
diff --git a/recipes-security/optee-imx/optee-test-fslc-imx.inc b/recipes-security/optee-imx/optee-test-fslc-imx.inc
new file mode 100644
index 00000000..ab16fd22
--- /dev/null
+++ b/recipes-security/optee-imx/optee-test-fslc-imx.inc
@@ -0,0 +1,18 @@
1# Copied from meta-imx/meta-imx-bsp/recipes-security/optee/optee-test-imx.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-scarthgap/imx-6.6.52-2.2.0.xml#L37
3
4require optee-test-fslc.inc
5
6DEPENDS += "openssl"
7
8FILESEXTRAPATHS:prepend := "${THISDIR}/optee-test:"
9
10SRC_URI:remove = "git://github.com/OP-TEE/optee_test.git;branch=master;protocol=https"
11SRC_URI:prepend = "${OPTEE_TEST_SRC};branch=${SRCBRANCH} "
12
13OPTEE_TEST_SRC ?= "git://github.com/nxp-imx/imx-optee-test.git;protocol=https"
14
15EXTRA_OEMAKE:append:libc-musl = " OPTEE_OPENSSL_EXPORT=${STAGING_INCDIR}"
16CFLAGS:append:libc-musl = " -Wno-error=deprecated-declarations"
17
18COMPATIBLE_MACHINE = "(imx-nxp-bsp)"
diff --git a/recipes-security/optee-imx/optee-test-fslc.inc b/recipes-security/optee-imx/optee-test-fslc.inc
index e0c133a7..0fb5f878 100644
--- a/recipes-security/optee-imx/optee-test-fslc.inc
+++ b/recipes-security/optee-imx/optee-test-fslc.inc
@@ -1,38 +1,65 @@
1# Copyright (C) 2017-2021 NXP 1# Copied from meta-arm/recipes-security/optee/optee-test.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-scarthgap/imx-6.6.52-2.2.0.xml#L30
3
4SUMMARY = "OP-TEE sanity testsuite"
5DESCRIPTION = "Open Portable Trusted Execution Environment - Test suite"
6HOMEPAGE = "https://www.op-tee.org/"
2 7
3SUMMARY = "OPTEE test"
4LICENSE = "BSD-2-Clause & GPL-2.0-only" 8LICENSE = "BSD-2-Clause & GPL-2.0-only"
5LIC_FILES_CHKSUM = "file://LICENSE.md;md5=daa2bcccc666345ab8940aab1315a4fa" 9LIC_FILES_CHKSUM = "file://LICENSE.md;md5=daa2bcccc666345ab8940aab1315a4fa"
6 10
11inherit python3native ptest
12inherit deploy
7require optee-fslc.inc 13require optee-fslc.inc
8 14
9DEPENDS += "optee-os optee-client openssl" 15DEPENDS = "optee-client optee-os-tadevkit python3-cryptography-native openssl"
16
17SRC_URI = "git://github.com/OP-TEE/optee_test.git;branch=master;protocol=https \
18 file://run-ptest \
19 "
20
21S = "${WORKDIR}/git"
22B = "${WORKDIR}/build"
10 23
11EXTRA_OEMAKE += " \ 24EXTRA_OEMAKE += "TA_DEV_KIT_DIR=${TA_DEV_KIT_DIR} \
12 TA_DEV_KIT_DIR=${STAGING_INCDIR}/optee/export-user_ta_${OPTEE_ARCH}/ \ 25 OPTEE_OPENSSL_EXPORT=${STAGING_INCDIR} \
13 CROSS_COMPILE_HOST=${HOST_PREFIX} \ 26 CROSS_COMPILE_HOST=${HOST_PREFIX} \
14 CROSS_COMPILE_TA=${HOST_PREFIX} \ 27 CROSS_COMPILE_TA=${HOST_PREFIX} \
15 CROSS_COMPILE=${HOST_PREFIX} \ 28 O=${B} \
16" 29 "
30
31CFLAGS += "-Wno-error=deprecated-declarations"
17 32
18do_compile() { 33do_compile() {
19 oe_runmake all 34 cd ${S}
35 # Top level makefile doesn't seem to handle parallel make gracefully
36 oe_runmake xtest
37 oe_runmake ta
38 oe_runmake test_plugin
20} 39}
21do_compile[cleandirs] = "${B}" 40do_compile[cleandirs] = "${B}"
22 41
23do_install () { 42do_install () {
24 install -d ${D}${bindir} 43 install -D -p -m0755 ${B}/xtest/xtest ${D}${bindir}/xtest
25 install ${B}/xtest/xtest ${D}${bindir}
26 44
27 install -d ${D}${nonarch_base_libdir}/optee_armtz 45 # install path should match the value set in optee-client/tee-supplicant
28 find ${B}/ta -name '*.ta' | while read name; do 46 # default TEEC_LOAD_PATH is /lib
29 install -m 444 $name ${D}${nonarch_base_libdir}/optee_armtz/ 47 mkdir -p ${D}${nonarch_base_libdir}/optee_armtz/
30 done 48 install -D -p -m0444 ${B}/ta/*/*.ta ${D}${nonarch_base_libdir}/optee_armtz/
49 mkdir -p ${D}${libdir}/tee-supplicant/plugins
50 install -D -p -m0444 ${B}/supp_plugin/*.plugin ${D}${libdir}/tee-supplicant/plugins/
51}
31 52
32 install -d ${D}${libdir}/tee-supplicant/plugins/ 53do_deploy () {
33 install ${B}/supp_plugin/*plugin ${D}${libdir}/tee-supplicant/plugins/ 54 install -d ${DEPLOYDIR}/${MLPREFIX}optee/ta
55 install -m 644 ${B}/ta/*/*.elf ${DEPLOYDIR}/${MLPREFIX}optee/ta
34} 56}
35 57
36FILES:${PN} += "${nonarch_base_libdir}/optee_armtz/ ${libdir}/tee-supplicant/plugins/" 58addtask deploy before do_build after do_install
59
60FILES:${PN} += "${nonarch_base_libdir}/optee_armtz/ \
61 ${libdir}/tee-supplicant/plugins/ \
62 "
37 63
38RDEPENDS:${PN} = "optee-os" 64# Imports machine specific configs from staging to build
65PACKAGE_ARCH = "${MACHINE_ARCH}"
diff --git a/recipes-security/optee-imx/optee-test/run-ptest b/recipes-security/optee-imx/optee-test/run-ptest
new file mode 100644
index 00000000..ba88c14d
--- /dev/null
+++ b/recipes-security/optee-imx/optee-test/run-ptest
@@ -0,0 +1,52 @@
1#!/bin/sh
2xtest | awk '
3
4 # Escapes the special characters in a string so that, when
5 # included in a regex, it represents a literal match
6 function regx_escape_literal(str, ret) {
7 ret = str
8 gsub(/[\[\]\^\$\.\*\?\+\{\}\\\(\)\|]/ , "\\\\&", str)
9 return str
10 }
11
12 # Returns the simple test formatted name
13 function name(n, ret) {
14 ret = n
15 gsub(/\./, " ", ret)
16 return ret
17 }
18
19 # Returns the simple test formatted result
20 function result(res) {
21 if(res ~ /OK/) {
22 return "PASS"
23 } else if(res ~ /FAILED/) {
24 return "FAIL"
25 }
26 }
27
28 function parse(name, description, has_subtests, result_line) {
29 has_subtests = 0
30
31 # Consume every line up to the result line
32 result_line = " " regx_escape_literal(name) " (OK|FAILED)"
33 do {
34 getline
35
36 # If this is a subtest (denoted by an "o" bullet) then subparse
37 if($0 ~ /^o /) {
38 parse($2, description " : " substr($0, index($0, $3)))
39 has_subtests = 1
40 }
41 } while ($0 !~ result_line)
42
43 # Only print the results for the deepest nested subtests
44 if(!has_subtests) {
45 print result($2) ": " name(name) " - " description
46 }
47 }
48
49 # Start parsing at the beginning of every test (denoted by a "*" bullet)
50 /^\* / { parse($2, substr($0, index($0, $3))) }
51
52'
diff --git a/recipes-security/optee-imx/optee-test_4.2.0.imx.bb b/recipes-security/optee-imx/optee-test_4.2.0.imx.bb
deleted file mode 100644
index e2cf40e9..00000000
--- a/recipes-security/optee-imx/optee-test_4.2.0.imx.bb
+++ /dev/null
@@ -1,10 +0,0 @@
1# Copyright 2017-2024 NXP
2
3require optee-test-fslc.inc
4
5SRC_URI = "git://github.com/nxp-imx/imx-optee-test.git;protocol=https;branch=${SRCBRANCH}"
6
7SRCBRANCH = "lf-6.6.36_2.1.0"
8SRCREV = "5b52b48a73b4cc3f228ec66ae6cf9920897bb2e6"
9
10COMPATIBLE_MACHINE = "(imx-nxp-bsp)"
diff --git a/recipes-security/optee-imx/optee-test_4.4.0.imx.bb b/recipes-security/optee-imx/optee-test_4.4.0.imx.bb
new file mode 100644
index 00000000..b4ac1271
--- /dev/null
+++ b/recipes-security/optee-imx/optee-test_4.4.0.imx.bb
@@ -0,0 +1,13 @@
1# Copyright 2017-2024 NXP
2
3require optee-test-fslc-imx.inc
4
5# The BSD and GPL license files are now included in the source
6# https://github.com/OP-TEE/optee_test/commit/a748f5fcd9ec8a574dc86a5aa56d05bc6ac174e7
7LIC_FILES_CHKSUM = "file://LICENSE.md;md5=a8fa504109e4cd7ea575bc49ea4be560 \
8 file://LICENSE-BSD;md5=dca16d6efa93b55d0fd662ae5cd6feeb \
9 file://LICENSE-GPL;md5=10e86b5d2a6cb0e2b9dcfdd26a9ac58d"
10
11
12SRCBRANCH = "lf-6.6.52_2.2.0"
13SRCREV = "dafc98ed8364d7281a9a7f0788dd0a2067844a59"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-05-31 09:50:52 +0000