summaryrefslogtreecommitdiffstats
path: root/recipes-security/optee-imx
diff options
context:
space:
mode:
Diffstat (limited to 'recipes-security/optee-imx')
-rw-r--r--recipes-security/optee-imx/optee-client-fslc-imx.inc16
-rw-r--r--recipes-security/optee-imx/optee-client-fslc.inc76
-rw-r--r--recipes-security/optee-imx/optee-client/0001-tee-supplicant-Fix-non-arch-service-unit-install-pat.patch35
-rw-r--r--recipes-security/optee-imx/optee-client/optee-udev.rules6
-rw-r--r--recipes-security/optee-imx/optee-client/tee-supplicant.service11
-rw-r--r--recipes-security/optee-imx/optee-client/tee-supplicant.sh46
-rw-r--r--recipes-security/optee-imx/optee-client/tee-supplicant@.service10
-rw-r--r--recipes-security/optee-imx/optee-client/tee-udev.rules7
-rw-r--r--recipes-security/optee-imx/optee-client_4.2.0.imx.bb7
-rw-r--r--recipes-security/optee-imx/optee-client_4.6.0.imx.bb4
-rw-r--r--recipes-security/optee-imx/optee-fslc.inc52
-rw-r--r--recipes-security/optee-imx/optee-os-common-fslc-imx.inc62
-rw-r--r--recipes-security/optee-imx/optee-os-fslc-imx.inc46
-rw-r--r--recipes-security/optee-imx/optee-os-fslc.inc105
-rw-r--r--recipes-security/optee-imx/optee-os-tadevkit-fslc-imx.inc24
-rw-r--r--recipes-security/optee-imx/optee-os-tadevkit_4.6.0.imx.bb4
-rw-r--r--recipes-security/optee-imx/optee-os/0001-core-Define-section-attributes-for-clang.patch245
-rw-r--r--recipes-security/optee-imx/optee-os/0003-arm32-libutils-libutee-ta-add-.note.GNU-stack-sectio.patch133
-rw-r--r--recipes-security/optee-imx/optee-os/0004-core-link-add-no-warn-rwx-segments.patch67
-rw-r--r--recipes-security/optee-imx/optee-os/0007-allow-setting-sysroot-for-clang.patch (renamed from recipes-security/optee-imx/optee-os/0002-optee-enable-clang-support.patch)14
-rw-r--r--recipes-security/optee-imx/optee-os_4.2.0.imx.bb12
-rw-r--r--recipes-security/optee-imx/optee-os_4.6.0.imx.bb6
-rw-r--r--recipes-security/optee-imx/optee-test-fslc-imx.inc18
-rw-r--r--recipes-security/optee-imx/optee-test-fslc.inc69
-rw-r--r--recipes-security/optee-imx/optee-test/run-ptest52
-rw-r--r--recipes-security/optee-imx/optee-test_4.2.0.imx.bb10
-rw-r--r--recipes-security/optee-imx/optee-test_4.6.0.imx.bb13
27 files changed, 506 insertions, 644 deletions
diff --git a/recipes-security/optee-imx/optee-client-fslc-imx.inc b/recipes-security/optee-imx/optee-client-fslc-imx.inc
index 60e9e1fa5..1112a864d 100644
--- a/recipes-security/optee-imx/optee-client-fslc-imx.inc
+++ b/recipes-security/optee-imx/optee-client-fslc-imx.inc
@@ -1,7 +1,17 @@
1# Copyright 2017-2024 NXP 1# Copied from meta-imx/meta-imx-bsp/recipes-security/optee/optee-client-imx.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-walnascar/imx-6.12.20-2.0.0.xml#L37
2 3
3require optee-client-fslc.inc 4require optee-client-fslc.inc
4 5
5SRC_URI += "git://github.com/nxp-imx/imx-optee-client.git;protocol=https;branch=${SRCBRANCH}" 6DEPENDS += "util-linux-libuuid"
6 7
7COMPATIBLE_MACHINE = "(imx-nxp-bsp)" 8FILESEXTRAPATHS:prepend := "${THISDIR}/optee-client:"
9SRC_URI:remove = "git://github.com/OP-TEE/optee_client.git;branch=master;protocol=https"
10SRC_URI:prepend = "${OPTEE_CLIENT_SRC};branch=${SRCBRANCH} "
11OPTEE_CLIENT_SRC ?= "git://github.com/nxp-imx/imx-optee-client.git;protocol=https"
12
13SRC_URI += "file://0001-tee-supplicant-Fix-non-arch-service-unit-install-pat.patch"
14
15inherit pkgconfig
16
17EXTRA_OECMAKE += "-DCFG_TEE_CLIENT_LOAD_PATH=${nonarch_base_libdir}"
diff --git a/recipes-security/optee-imx/optee-client-fslc.inc b/recipes-security/optee-imx/optee-client-fslc.inc
index f55f0ab24..70a25fe6c 100644
--- a/recipes-security/optee-imx/optee-client-fslc.inc
+++ b/recipes-security/optee-imx/optee-client-fslc.inc
@@ -1,42 +1,60 @@
1# Copyright 2017-2024 NXP 1# Copied from meta-arm/recipes-security/optee/optee-client.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-walnascar/imx-6.12.20-2.0.0.xml#L30
3
4SUMMARY = "OP-TEE Client API"
5DESCRIPTION = "Open Portable Trusted Execution Environment - Normal World Client side of the TEE"
6HOMEPAGE = "https://www.op-tee.org/"
2 7
3SUMMARY = "OPTEE Client libs"
4HOMEPAGE = "http://www.optee.org/"
5LICENSE = "BSD-2-Clause" 8LICENSE = "BSD-2-Clause"
6LIC_FILES_CHKSUM = "file://LICENSE;md5=69663ab153298557a59c67a60a743e5b" 9LIC_FILES_CHKSUM = "file://LICENSE;md5=69663ab153298557a59c67a60a743e5b"
7 10
8SRC_URI = "file://tee-supplicant.service" 11inherit systemd update-rc.d cmake useradd
9
10S = "${WORKDIR}/git"
11B = "${WORKDIR}/build"
12
13inherit python3native systemd features_check pkgconfig
14
15DEPENDS = "util-linux-libuuid"
16 12
17REQUIRED_MACHINE_FEATURES = "optee" 13SRC_URI = " \
14 git://github.com/OP-TEE/optee_client.git;branch=master;protocol=https \
15 file://tee-supplicant.sh \
16"
18 17
19SYSTEMD_SERVICE:${PN} = "tee-supplicant.service" 18UPSTREAM_CHECK_GITTAGREGEX = "^(?P<pver>\d+(\.\d+)+)$"
20 19
21EXTRA_OEMAKE = " \ 20EXTRA_OECMAKE = " \
22 -C ${S} O=${B} \ 21 -DBUILD_SHARED_LIBS=ON \
22 -DCFG_USE_PKGCONFIG=ON \
23" 23"
24 24
25do_install () { 25# libts uses /dev/tee devices too. Add a common variable to allow configuring the same group.
26 oe_runmake -C ${S} install 26TEE_GROUP_NAME ?= "tee"
27 27
28 install -D -p -m0644 ${B}/export/usr/lib/libteec.so.2.0.0 ${D}${libdir}/libteec.so.2.0.0 28EXTRA_OECMAKE += " -DCFG_ENABLE_SYSTEMD=On -DSYSTEMD_UNIT_DIR=${systemd_system_unitdir}/"
29 ln -sf libteec.so.2.0.0 ${D}${libdir}/libteec.so.2 29EXTRA_OECMAKE += " -DCFG_ENABLE_UDEV=On -DUDEV_UDEV_DIR=${nonarch_base_libdir}/udev/rules.d/"
30 ln -sf libteec.so.2.0.0 ${D}${libdir}/libteec.so 30EXTRA_OECMAKE += " -DCFG_TEE_GROUP=${TEE_GROUP_NAME} -DCFG_TEEPRIV_GROUP=teepriv"
31
32EXTRA_OECMAKE:append:toolchain-clang = " -DCFG_WERROR=0"
33
34do_install:append() {
35 if ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'true', 'false', d)}; then
36 install -D -p -m0755 ${UNPACKDIR}/tee-supplicant.sh ${D}${sysconfdir}/init.d/tee-supplicant
37 sed -i -e s:@sysconfdir@:${sysconfdir}:g \
38 -e s:@sbindir@:${sbindir}:g \
39 -e s:@supluser@:teesuppl:g \
40 -e s:@suplgroup@:teesuppl:g \
41 ${D}${sysconfdir}/init.d/tee-supplicant
42 fi
43 install -o teesuppl -g teesuppl -m 0700 -d ${D}${localstatedir}/lib/tee
44}
31 45
32 install -D -p -m0644 ${B}/export/usr/lib/libckteec.so.0.1.0 ${D}${libdir}/libckteec.so.0.1.0 46SYSTEMD_SERVICE:${PN} = "tee-supplicant@.service"
33 ln -sf libckteec.so.0.1.0 ${D}${libdir}/libckteec.so.0
34 ln -sf libckteec.so.0.1.0 ${D}${libdir}/libckteec.so
35 47
36 install -D -p -m0755 ${B}/export/usr/sbin/tee-supplicant ${D}${bindir}/tee-supplicant 48INITSCRIPT_PACKAGES = "${PN}"
49INITSCRIPT_NAME:${PN} = "tee-supplicant"
50INITSCRIPT_PARAMS:${PN} = "start 10 1 2 3 4 5 . stop 90 0 6 ."
37 51
38 cp -a ${B}/export/usr/include ${D}${includedir} 52FILES:${PN} += "${nonarch_base_libdir}/udev/rules.d/"
39 53
40 sed -i -e s:/etc:${sysconfdir}:g -e s:/usr/bin:${bindir}:g ${UNPACKDIR}/tee-supplicant.service 54# Users and groups:
41 install -D -p -m0644 ${UNPACKDIR}/tee-supplicant.service ${D}${systemd_system_unitdir}/tee-supplicant.service 55# TEE_GROUP_NAME group to access /dev/tee*
42} 56# teepriv group to acess /dev/teepriv*, only tee-supplicant
57# teesuppl user and group teesuppl to run tee-supplicant
58USERADD_PACKAGES = "${PN}"
59GROUPADD_PARAM:${PN} = "--system ${TEE_GROUP_NAME}; --system teepriv; --system teesuppl"
60USERADD_PARAM:${PN} = "--system -g teesuppl --groups teepriv --home-dir ${localstatedir}/lib/tee -M --shell /sbin/nologin teesuppl;"
diff --git a/recipes-security/optee-imx/optee-client/0001-tee-supplicant-Fix-non-arch-service-unit-install-pat.patch b/recipes-security/optee-imx/optee-client/0001-tee-supplicant-Fix-non-arch-service-unit-install-pat.patch
new file mode 100644
index 000000000..631e08019
--- /dev/null
+++ b/recipes-security/optee-imx/optee-client/0001-tee-supplicant-Fix-non-arch-service-unit-install-pat.patch
@@ -0,0 +1,35 @@
1From 5ffab66dda3e25f0b2ebc5115013c4234d048703 Mon Sep 17 00:00:00 2001
2From: Tom Hochstein <tom.hochstein@nxp.com>
3Date: Mon, 21 Apr 2025 08:47:29 -0500
4Subject: [PATCH] tee-supplicant: Fix non-arch service unit install path
5
6A 64-bit build with multilib enabled fails:
7```
8ERROR: optee-client-4.4.0-r0 do_package: Didn't find service unit 'tee-supplicant@.service', specified in SYSTEMD_SERVICE:optee-client. Also looked for service unit 'tee-supplicant@.service'.
9```
10
11The problem is the service unit is installed in the arch-specific folder
12/usr/lib64/systemd/system, but it is non-arch and should be in
13/usr/lib/systemd/system.
14
15Upstream-Status: Pending
16Signed-off-by: Tom Hochstein <tom.hochstein@nxp.com>
17---
18 tee-supplicant/CMakeLists.txt | 2 +-
19 1 file changed, 1 insertion(+), 1 deletion(-)
20
21diff --git a/tee-supplicant/CMakeLists.txt b/tee-supplicant/CMakeLists.txt
22index 8df9bef..3ea058c 100644
23--- a/tee-supplicant/CMakeLists.txt
24+++ b/tee-supplicant/CMakeLists.txt
25@@ -119,6 +119,6 @@ endif()
26 ################################################################################
27 install(TARGETS ${PROJECT_NAME} RUNTIME DESTINATION ${CMAKE_INSTALL_SBINDIR})
28 configure_file(tee-supplicant@.service.in tee-supplicant@.service @ONLY)
29-install(FILES ${CMAKE_BINARY_DIR}/${PROJECT_NAME}/tee-supplicant@.service DESTINATION ${CMAKE_INSTALL_LIBDIR}/systemd/system)
30+install(FILES ${CMAKE_BINARY_DIR}/${PROJECT_NAME}/tee-supplicant@.service DESTINATION lib/systemd/system)
31 configure_file(optee-udev.rules.in optee-udev.rules @ONLY)
32 install(FILES ${CMAKE_BINARY_DIR}/${PROJECT_NAME}/optee-udev.rules DESTINATION ${CMAKE_INSTALL_SYSCONFDIR}/udev/rules.d)
33--
342.34.1
35
diff --git a/recipes-security/optee-imx/optee-client/optee-udev.rules b/recipes-security/optee-imx/optee-client/optee-udev.rules
new file mode 100644
index 000000000..075f469c0
--- /dev/null
+++ b/recipes-security/optee-imx/optee-client/optee-udev.rules
@@ -0,0 +1,6 @@
1KERNEL=="tee[0-9]*", MODE="0660", OWNER="root", GROUP="teeclnt", TAG+="systemd"
2
3# If a /dev/teepriv[0-9]* device is detected, start an instance of
4# tee-supplicant.service with the device name as parameter
5KERNEL=="teepriv[0-9]*", MODE="0660", OWNER="root", GROUP="teeclnt", \
6 TAG+="systemd", ENV{SYSTEMD_WANTS}+="tee-supplicant@%k.service"
diff --git a/recipes-security/optee-imx/optee-client/tee-supplicant.service b/recipes-security/optee-imx/optee-client/tee-supplicant.service
deleted file mode 100644
index 0e2b4f6ba..000000000
--- a/recipes-security/optee-imx/optee-client/tee-supplicant.service
+++ /dev/null
@@ -1,11 +0,0 @@
1[Unit]
2Description=TEE Supplicant
3
4[Service]
5User=root
6EnvironmentFile=-/etc/default/tee-supplicant
7ExecStart=/usr/bin/tee-supplicant $OPTARGS
8
9[Install]
10WantedBy=basic.target
11
diff --git a/recipes-security/optee-imx/optee-client/tee-supplicant.sh b/recipes-security/optee-imx/optee-client/tee-supplicant.sh
new file mode 100644
index 000000000..b4d219502
--- /dev/null
+++ b/recipes-security/optee-imx/optee-client/tee-supplicant.sh
@@ -0,0 +1,46 @@
1#!/bin/sh
2
3# Source function library
4. /etc/init.d/functions
5
6NAME=tee-supplicant
7PATH=/sbin:/bin:/usr/sbin:/usr/bin
8DESC="OP-TEE Supplicant"
9
10DAEMON=@sbindir@/$NAME
11
12test -f $DAEMON || exit 0
13
14test -f @sysconfdir@/default/$NAME && . @sysconfdir@/default/$NAME
15test -f @sysconfdir@/default/rcS && . @sysconfdir@/default/rcS
16
17SSD_OPTIONS="--oknodo --quiet --exec $DAEMON -- -d $OPTARGS"
18
19set -e
20
21case $1 in
22 start)
23 echo -n "Starting $DESC: "
24 start-stop-daemon --start $SSD_OPTIONS
25 echo "${DAEMON##*/}."
26 ;;
27 stop)
28 echo -n "Stopping $DESC: "
29 start-stop-daemon --stop $SSD_OPTIONS
30 echo "${DAEMON##*/}."
31 ;;
32 restart|force-reload)
33 $0 stop
34 sleep 1
35 $0 start
36 ;;
37 status)
38 status ${DAEMON} || exit $?
39 ;;
40 *)
41 echo "Usage: $0 {start|stop|restart|force-reload|status}" >&2
42 exit 1
43 ;;
44esac
45
46exit 0
diff --git a/recipes-security/optee-imx/optee-client/tee-supplicant@.service b/recipes-security/optee-imx/optee-client/tee-supplicant@.service
new file mode 100644
index 000000000..72c0b9aa5
--- /dev/null
+++ b/recipes-security/optee-imx/optee-client/tee-supplicant@.service
@@ -0,0 +1,10 @@
1[Unit]
2Description=TEE Supplicant on %i
3
4[Service]
5User=root
6EnvironmentFile=-@sysconfdir@/default/tee-supplicant
7ExecStart=@sbindir@/tee-supplicant $OPTARGS
8
9[Install]
10WantedBy=basic.target
diff --git a/recipes-security/optee-imx/optee-client/tee-udev.rules b/recipes-security/optee-imx/optee-client/tee-udev.rules
new file mode 100644
index 000000000..43fafd8c9
--- /dev/null
+++ b/recipes-security/optee-imx/optee-client/tee-udev.rules
@@ -0,0 +1,7 @@
1# tee devices can only be accessed by the teeclnt group members
2KERNEL=="tee[0-9]*", TAG+="systemd", MODE="0660", GROUP="teeclnt"
3
4# If a /dev/teepriv[0-9]* device is detected, start an instance of
5# tee-supplicant.service with the device name as parameter
6KERNEL=="teepriv[0-9]*", MODE="0660", OWNER="root", GROUP="tee", \
7 TAG+="systemd", ENV{SYSTEMD_WANTS}+="tee-supplicant@%k.service"
diff --git a/recipes-security/optee-imx/optee-client_4.2.0.imx.bb b/recipes-security/optee-imx/optee-client_4.2.0.imx.bb
deleted file mode 100644
index 64b49b752..000000000
--- a/recipes-security/optee-imx/optee-client_4.2.0.imx.bb
+++ /dev/null
@@ -1,7 +0,0 @@
1require optee-client-fslc-imx.inc
2
3SRCBRANCH = "lf-6.6.23_2.0.0"
4SRCREV = "3eac340a781c00ccd61b151b0e9c22a8c6e9f9f0"
5
6DEPENDS += "util-linux"
7EXTRA_OEMAKE += "PKG_CONFIG=pkg-config"
diff --git a/recipes-security/optee-imx/optee-client_4.6.0.imx.bb b/recipes-security/optee-imx/optee-client_4.6.0.imx.bb
new file mode 100644
index 000000000..b5a185da1
--- /dev/null
+++ b/recipes-security/optee-imx/optee-client_4.6.0.imx.bb
@@ -0,0 +1,4 @@
1require optee-client-fslc-imx.inc
2
3SRCBRANCH = "lf-6.12.20_2.0.0"
4SRCREV = "02e7f9213b0d7db9c35ebf1e41e733fc9c5a3f75"
diff --git a/recipes-security/optee-imx/optee-fslc.inc b/recipes-security/optee-imx/optee-fslc.inc
index 6c96dc2bc..599dda522 100644
--- a/recipes-security/optee-imx/optee-fslc.inc
+++ b/recipes-security/optee-imx/optee-fslc.inc
@@ -1,26 +1,42 @@
1HOMEPAGE = "http://www.optee.org/" 1# Copied from meta-arm/recipes-security/optee/optee.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-walnascar/imx-6.12.20-2.0.0.xml#L30
2 3
3inherit python3native features_check 4UPSTREAM_CHECK_GITTAGREGEX = "^(?P<pver>\d+(\.\d+)+)$"
4 5
5REQUIRED_MACHINE_FEATURES = "optee" 6COMPATIBLE_MACHINE ?= "invalid"
7COMPATIBLE_MACHINE:genericarm64 ?= "genericarm64"
8COMPATIBLE_MACHINE:qemuarm64 ?= "qemuarm64"
9COMPATIBLE_MACHINE:qemuarm ?= "qemuarm"
10# Please add supported machines below or set it in .bbappend or .conf
6 11
7DEPENDS = "python3-cryptography-native" 12OPTEEMACHINE ?= "${MACHINE}"
13OPTEEMACHINE:genericarm64 ?= "vexpress-qemu_armv8a"
14OPTEEMACHINE:aarch64:qemuall ?= "vexpress-qemu_armv8a"
15OPTEEMACHINE:arm:qemuall ?= "vexpress-qemu_virt"
8 16
9S = "${WORKDIR}/git" 17OPTEE_ARCH = "null"
10B = "${WORKDIR}/build" 18OPTEE_ARCH:arm = "arm32"
11
12OPTEE_ARCH:arm = "arm32"
13OPTEE_ARCH:aarch64 = "arm64" 19OPTEE_ARCH:aarch64 = "arm64"
20OPTEE_CORE = "${@d.getVar('OPTEE_ARCH').upper()}"
21
22OPTEE_TOOLCHAIN = "${@d.getVar('TOOLCHAIN') or 'gcc'}"
23OPTEE_COMPILER = "${@bb.utils.contains("BBFILE_COLLECTIONS", "clang-layer", "${OPTEE_TOOLCHAIN}", "gcc", d)}"
14 24
15COMPILER ?= "gcc" 25# Set here but not passed to EXTRA_OEMAKE by default as that breaks
16COMPILER:toolchain-clang = "clang" 26# the optee-os build
27TA_DEV_KIT_DIR = "${STAGING_INCDIR}/optee/export-user_ta"
28
29EXTRA_OEMAKE += "V=1 \
30 LIBGCC_LOCATE_CFLAGS='${HOST_CC_ARCH}${TOOLCHAIN_OPTIONS}' \
31 COMPILER=${OPTEE_COMPILER} \
32 OPTEE_CLIENT_EXPORT=${STAGING_DIR_HOST}${prefix} \
33 TEEC_EXPORT=${STAGING_DIR_HOST}${prefix} \
34 "
35# python3-cryptography needs the legacy provider, so set OPENSSL_MODULES to the
36# right path until this is relocated automatically.
37export OPENSSL_MODULES = "${STAGING_LIBDIR_NATIVE}/ossl-modules"
17 38
18CFLAGS += "--sysroot=${STAGING_DIR_HOST}" 39CFLAGS += "--sysroot=${STAGING_DIR_HOST}"
19CXXFLAGS += "--sysroot=${STAGING_DIR_HOST}" 40
20 41# See the rationale in https://github.com/f-secure-foundry/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2021-0001-OP-TEE_TrustZone_bypass.txt.
21EXTRA_OEMAKE = " \ 42CVE_STATUS[CVE-2021-36133] = "disputed: devices shipped open for development purposes"
22 COMPILER=${COMPILER} \
23 OPENSSL_MODULES=${STAGING_LIBDIR_NATIVE}/ossl-modules \
24 OPTEE_CLIENT_EXPORT=${STAGING_DIR_HOST}${exec_prefix} \
25 -C ${S} O=${B} \
26"
diff --git a/recipes-security/optee-imx/optee-os-common-fslc-imx.inc b/recipes-security/optee-imx/optee-os-common-fslc-imx.inc
new file mode 100644
index 000000000..ffd217099
--- /dev/null
+++ b/recipes-security/optee-imx/optee-os-common-fslc-imx.inc
@@ -0,0 +1,62 @@
1# Copied from meta-imx/meta-imx-bsp/recipes-security/optee/optee-os-common-imx.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-walnascar/imx-6.12.20-2.0.0.xml#L37
3require optee-os-fslc.inc
4
5DEPENDS:append:arm = "u-boot-mkimage-native"
6
7FILESEXTRAPATHS:prepend := "${THISDIR}/optee-os:"
8
9SRC_URI:remove = "git://github.com/OP-TEE/optee_os.git;branch=master;protocol=https"
10SRC_URI:prepend = "${OPTEE_OS_SRC};branch=${SRCBRANCH} "
11SRC_URI:append = " file://0007-allow-setting-sysroot-for-clang.patch"
12SRC_URI:remove = "file://0001-allow-setting-sysroot-for-libgcc-lookup.patch \
13 file://0002-optee-enable-clang-support.patch \
14 file://0003-core-link-add-no-warn-rwx-segments.patch"
15
16OPTEE_OS_SRC ?= "git://github.com/nxp-imx/imx-optee-os.git;protocol=https"
17
18inherit features_check
19
20REQUIRED_MACHINE_FEATURES = "optee"
21
22OPTEEMACHINE = "imx-${@d.getVar('MACHINE')[1:]}"
23OPTEEMACHINE:imx6qpdlsolox = "imx-mx6qsabresd"
24OPTEEMACHINE:mx6ul-nxp-bsp = "imx-mx6ulevk"
25OPTEEMACHINE:mx6ull-nxp-bsp = "imx-mx6ullevk"
26OPTEEMACHINE:mx6ulz-nxp-bsp = "imx-mx6ulzevk"
27OPTEEMACHINE:mx8mq-nxp-bsp = "imx-mx8mqevk"
28OPTEEMACHINE:mx8mm-nxp-bsp = "imx-mx8mmevk"
29OPTEEMACHINE:mx8mn-nxp-bsp = "imx-mx8mnevk"
30OPTEEMACHINE:mx8mp-nxp-bsp = "imx-mx8mpevk"
31OPTEEMACHINE:mx8mpul-nxp-bsp = "imx-mx8mpevk"
32OPTEEMACHINE:mx8qm-nxp-bsp = "imx-mx8qmmek"
33OPTEEMACHINE:mx8qxp-nxp-bsp = "imx-mx8qxpmek"
34OPTEEMACHINE:mx8dx-nxp-bsp = "imx-mx8dxmek"
35OPTEEMACHINE:mx8dxl-nxp-bsp = "imx-mx8dxlevk"
36OPTEEMACHINE:mx8mnul-nxp-bsp = "imx-mx8mnevk"
37OPTEEMACHINE:mx8ulp-nxp-bsp = "imx-mx8ulpevk"
38OPTEEMACHINE:mx91-nxp-bsp = "imx-mx91evk"
39OPTEEMACHINE:mx93-nxp-bsp = "imx-mx93evk"
40OPTEEMACHINE:mx943-nxp-bsp = "imx-mx943evk"
41OPTEEMACHINE:mx95-nxp-bsp = "imx-mx95evk"
42
43# Strip the leading imx-
44PLATFORM_FLAVOR = "${@d.getVar('OPTEEMACHINE')[4:]}"
45
46EXTRA_OEMAKE:append = " \
47 CFG_TEE_TA_LOG_LEVEL=0 \
48 CFG_TEE_CORE_LOG_LEVEL=0 \
49"
50
51EXTRA_OEMAKE:append:imx8mq-lpddr4-wevk = " \
52 CFG_CORE_LARGE_PHYS_ADDR=y \
53 CFG_CORE_ARM64_PA_BITS=36 \
54 CFG_DDR_SIZE=0x100000000 \
55 CFG_TZDRAM_START=0xfe000000 \
56"
57
58EXTRA_OEMAKE:append:imx8dxlb0-fips-lpddr4-evk = " \
59 CFG_NXP_CAAM=n \
60"
61
62COMPATIBLE_MACHINE = "(imx-nxp-bsp)"
diff --git a/recipes-security/optee-imx/optee-os-fslc-imx.inc b/recipes-security/optee-imx/optee-os-fslc-imx.inc
index 6b72e8277..f46f666ee 100644
--- a/recipes-security/optee-imx/optee-os-fslc-imx.inc
+++ b/recipes-security/optee-imx/optee-os-fslc-imx.inc
@@ -1,26 +1,26 @@
1require optee-os-fslc.inc 1# Copied from meta-imx/meta-imx-bsp/recipes-security/optee/optee-os-imx.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-walnascar/imx-6.12.20-2.0.0.xml#L37
2 3
3SRC_URI = "git://github.com/nxp-imx/imx-optee-os.git;protocol=https;branch=${SRCBRANCH}" 4require optee-os-common-fslc-imx.inc
4 5
5# The platform flavor corresponds to the Yocto machine without the leading 'i'. 6do_compile:arm() {
6PLATFORM_FLAVOR = "${@d.getVar('MACHINE')[1:]}" 7 oe_runmake -C ${S} all uTee
7PLATFORM_FLAVOR:imx6qdlsabresd = "mx6qsabresd" 8}
8PLATFORM_FLAVOR:imx6qdlsabreauto = "mx6qsabreauto"
9PLATFORM_FLAVOR:imx6qpdlsolox = "mx6qsabresd"
10PLATFORM_FLAVOR:mx6ul-nxp-bsp = "mx6ulevk"
11PLATFORM_FLAVOR:mx6ull-nxp-bsp = "mx6ullevk"
12PLATFORM_FLAVOR:mx6ulz-nxp-bsp = "mx6ulzevk"
13PLATFORM_FLAVOR:mx8mq-nxp-bsp = "mx8mqevk"
14PLATFORM_FLAVOR:mx8mm-nxp-bsp = "mx8mmevk"
15PLATFORM_FLAVOR:mx8mn-nxp-bsp = "mx8mnevk"
16PLATFORM_FLAVOR:mx8mnul-nxp-bsp = "mx8mnevk"
17PLATFORM_FLAVOR:mx8mp-nxp-bsp = "mx8mpevk"
18PLATFORM_FLAVOR:mx8mpul-nxp-bsp = "mx8mpevk"
19PLATFORM_FLAVOR:mx8qm-nxp-bsp = "mx8qmmek"
20PLATFORM_FLAVOR:mx8qxp-nxp-bsp = "mx8qxpmek"
21PLATFORM_FLAVOR:mx8dx-nxp-bsp = "mx8dxmek"
22PLATFORM_FLAVOR:mx8dxl-nxp-bsp = "mx8dxlevk"
23PLATFORM_FLAVOR:mx8ulp-nxp-bsp = "mx8ulpevk"
24PLATFORM_FLAVOR:mx93-nxp-bsp = "mx93evk"
25 9
26COMPATIBLE_MACHINE = "(imx-nxp-bsp)" 10do_install:append () {
11 # Install embedded TAs
12 install -d ${D}${nonarch_base_libdir}/optee_armtz/
13 install -m 444 ${B}/ta/*/*.ta ${D}${nonarch_base_libdir}/optee_armtz/
14}
15
16do_deploy:append() {
17 cp ${B}/core/tee-raw.bin ${DEPLOYDIR}/${MLPREFIX}optee/tee.${PLATFORM_FLAVOR}.bin
18 ln -sf ${MLPREFIX}optee/tee.${PLATFORM_FLAVOR}.bin ${DEPLOYDIR}/tee.bin
19}
20
21do_deploy:append:arm() {
22 cp ${B}/core/uTee ${DEPLOYDIR}/${MLPREFIX}optee/uTee-${OPTEE_BIN_EXT}
23 ln -sf ${MLPREFIX}optee/uTee-${OPTEE_BIN_EXT} ${DEPLOYDIR}/uTee-${OPTEE_BIN_EXT}
24}
25
26FILES:${PN} += "${nonarch_base_libdir}/optee_armtz"
diff --git a/recipes-security/optee-imx/optee-os-fslc.inc b/recipes-security/optee-imx/optee-os-fslc.inc
index b91a55311..4df1617d1 100644
--- a/recipes-security/optee-imx/optee-os-fslc.inc
+++ b/recipes-security/optee-imx/optee-os-fslc.inc
@@ -1,87 +1,82 @@
1# Copyright (C) 2017-2021 NXP 1# Copied from meta-arm/recipes-security/optee/optee-os.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-walnascar/imx-6.12.20-2.0.0.xml#L30
3
4SUMMARY = "OP-TEE Trusted OS"
5DESCRIPTION = "Open Portable Trusted Execution Environment - Trusted side of the TEE"
6HOMEPAGE = "https://www.op-tee.org/"
2 7
3SUMMARY = "OPTEE OS"
4DESCRIPTION = "OPTEE OS"
5LICENSE = "BSD-2-Clause" 8LICENSE = "BSD-2-Clause"
6LIC_FILES_CHKSUM = "file://LICENSE;md5=c1f21c4f72f372ef38a5a4aee55ec173" 9LIC_FILES_CHKSUM = "file://LICENSE;md5=c1f21c4f72f372ef38a5a4aee55ec173"
7 10
11inherit deploy python3native
8require optee-fslc.inc 12require optee-fslc.inc
9 13
10DEPENDS += "python3-pyelftools-native u-boot-mkimage-native" 14CVE_PRODUCT = "linaro:op-tee op-tee:op-tee_os"
15
16DEPENDS = "python3-pyelftools-native python3-cryptography-native"
17
11DEPENDS:append:toolchain-clang = " compiler-rt" 18DEPENDS:append:toolchain-clang = " compiler-rt"
12 19
13inherit deploy autotools 20SRC_URI = "git://github.com/OP-TEE/optee_os.git;branch=master;protocol=https"
14 21
15# Optee-os can be built for 32 bits and 64 bits at the same time 22B = "${WORKDIR}/build"
16# as long as the compilers are correctly defined.
17# For 64bits, CROSS_COMPILE64 must be set
18# When defining CROSS_COMPILE and CROSS_COMPILE64, we assure that
19# any 32 or 64 bits builds will pass
20EXTRA_OEMAKE += " \
21 PLATFORM=imx-${PLATFORM_FLAVOR} \
22 CROSS_COMPILE=${HOST_PREFIX} \
23 CROSS_COMPILE64=${HOST_PREFIX} \
24 CFLAGS32=--sysroot=${STAGING_DIR_HOST} \
25 CFLAGS64=--sysroot=${STAGING_DIR_HOST} \
26 CFG_TEE_TA_LOG_LEVEL=0 \
27 CFG_TEE_CORE_LOG_LEVEL=0 \
28"
29 23
30EXTRA_OEMAKE:append:imx8mq-lpddr4-wevk = " \ 24EXTRA_OEMAKE += " \
31 CFG_CORE_LARGE_PHYS_ADDR=y \ 25 PLATFORM=${OPTEEMACHINE} \
32 CFG_CORE_ARM64_PA_BITS=36 \ 26 CFG_${OPTEE_CORE}_core=y \
33 CFG_DDR_SIZE=0x100000000 \ 27 CROSS_COMPILE_core=${HOST_PREFIX} \
34 CFG_TZDRAM_START=0xfe000000 \ 28 CROSS_COMPILE_ta_${OPTEE_ARCH}=${HOST_PREFIX} \
29 AFLAGS="${CFLAGS}" \
30 ta-targets=ta_${OPTEE_ARCH} \
31 O=${B} \
35" 32"
33EXTRA_OEMAKE += " HOST_PREFIX=${HOST_PREFIX}"
34EXTRA_OEMAKE += " CROSS_COMPILE64=${HOST_PREFIX}"
36 35
37LDFLAGS[unexport] = "1" 36LDFLAGS[unexport] = "1"
38CPPFLAGS[unexport] = "1" 37CPPFLAGS[unexport] = "1"
39AS[unexport] = "1" 38AS[unexport] = "1"
40LD[unexport] = "1" 39LD[unexport] = "1"
41 40
42do_configure[noexec] = "1"
43
44do_compile:prepend() { 41do_compile:prepend() {
45 PLAT_LIBGCC_PATH=$(${CC} -print-libgcc-file-name) 42 PLAT_LIBGCC_PATH=$(${CC} -print-libgcc-file-name)
46}
47
48do_compile:arm () {
49 oe_runmake all uTee
50} 43}
51 44
52do_compile:aarch64 () { 45do_compile() {
53 oe_runmake all 46 oe_runmake -C ${S} all
54} 47}
55do_compile[cleandirs] = "${B}" 48do_compile[cleandirs] = "${B}"
56 49
57do_deploy () { 50do_install() {
58 install -d ${DEPLOYDIR} 51 #install core in firmware
59 cp ${B}/core/tee-raw.bin ${DEPLOYDIR}/tee.${PLATFORM_FLAVOR}.bin 52 install -d ${D}${nonarch_base_libdir}/firmware/
60 ln -sf tee.${PLATFORM_FLAVOR}.bin ${DEPLOYDIR}/tee.bin 53 install -m 644 ${B}/core/*.bin ${B}/core/tee.elf ${D}${nonarch_base_libdir}/firmware/
61}
62 54
63do_deploy:append:arm () { 55 #install tas in optee_armtz
64 cp ${B}/core/uTee ${DEPLOYDIR}/uTee-${OPTEE_BIN_EXT} 56 install -d ${D}${nonarch_base_libdir}/optee_armtz/
57 install -m 444 ${B}/ta/*/*.ta ${D}${nonarch_base_libdir}/optee_armtz
65} 58}
66 59
67do_install () { 60PACKAGE_ARCH = "${MACHINE_ARCH}"
68 install -d ${D}${nonarch_base_libdir}/firmware/
69 install -m 644 ${B}/core/*.bin ${D}${nonarch_base_libdir}/firmware/
70 61
71 # Install embedded TAs 62do_deploy() {
72 install -d ${D}${nonarch_base_libdir}/optee_armtz/ 63 install -d ${DEPLOYDIR}/${MLPREFIX}optee
73 install -m 444 ${B}/ta/*/*.ta ${D}${nonarch_base_libdir}/optee_armtz/ 64 install -m 644 ${D}${nonarch_base_libdir}/firmware/* ${DEPLOYDIR}/${MLPREFIX}optee
74 65
75 # Install the TA devkit 66 install -d ${DEPLOYDIR}/${MLPREFIX}optee/ta
76 install -d ${D}${includedir}/optee/export-user_ta_${OPTEE_ARCH}/ 67 install -m 644 ${B}/ta/*/*.elf ${DEPLOYDIR}/${MLPREFIX}optee/ta
77 cp -aR ${B}/export-ta_${OPTEE_ARCH}/* \
78 ${D}${includedir}/optee/export-user_ta_${OPTEE_ARCH}/
79} 68}
80 69
81addtask deploy after do_compile before do_install 70addtask deploy before do_build after do_install
82 71
83FILES:${PN} = "${nonarch_base_libdir}/firmware/ ${nonarch_base_libdir}/optee_armtz/" 72SYSROOT_DIRS += "${nonarch_base_libdir}/firmware"
84FILES:${PN}-staticdev = "${includedir}/optee/"
85RDEPENDS:${PN}-dev += "${PN}-staticdev"
86 73
87PACKAGE_ARCH = "${MACHINE_ARCH}" 74PACKAGES += "${PN}-ta"
75FILES:${PN} = "${nonarch_base_libdir}/firmware/"
76FILES:${PN}-ta = "${nonarch_base_libdir}/optee_armtz/*"
77
78
79# note: "textrel" is not triggered on all archs
80INSANE_SKIP:${PN} = "textrel"
81INSANE_SKIP:${PN}-dev = "staticdev"
82INHIBIT_PACKAGE_STRIP = "1"
diff --git a/recipes-security/optee-imx/optee-os-tadevkit-fslc-imx.inc b/recipes-security/optee-imx/optee-os-tadevkit-fslc-imx.inc
new file mode 100644
index 000000000..0b02c6908
--- /dev/null
+++ b/recipes-security/optee-imx/optee-os-tadevkit-fslc-imx.inc
@@ -0,0 +1,24 @@
1# Copied from meta-imx/meta-imx-bsp/recipes-security/optee/optee-os-tadevkit-imx.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-walnascar/imx-6.12.20-2.0.0.xml#L37
3
4require optee-os-common-fslc-imx.inc
5
6SUMMARY = "OP-TEE Trusted OS TA devkit"
7DESCRIPTION = "OP-TEE TA devkit for build TAs"
8HOMEPAGE = "https://www.op-tee.org/"
9
10DEPENDS += "python3-pycryptodome-native"
11
12do_install() {
13 #install TA devkit
14 install -d ${D}${includedir}/optee/export-user_ta/
15 for f in ${B}/export-ta_${OPTEE_ARCH}/* ; do
16 cp -aR $f ${D}${includedir}/optee/export-user_ta/
17 done
18}
19
20do_deploy() {
21 echo "Do not inherit do_deploy from optee-os."
22}
23
24FILES:${PN} = "${includedir}/optee/"
diff --git a/recipes-security/optee-imx/optee-os-tadevkit_4.6.0.imx.bb b/recipes-security/optee-imx/optee-os-tadevkit_4.6.0.imx.bb
new file mode 100644
index 000000000..92bdf00e7
--- /dev/null
+++ b/recipes-security/optee-imx/optee-os-tadevkit_4.6.0.imx.bb
@@ -0,0 +1,4 @@
1require optee-os-tadevkit-fslc-imx.inc
2
3SRCBRANCH = "lf-6.12.20_2.0.0"
4SRCREV = "87964807d80baf1dcfd89cafc66de34a1cf16bf3"
diff --git a/recipes-security/optee-imx/optee-os/0001-core-Define-section-attributes-for-clang.patch b/recipes-security/optee-imx/optee-os/0001-core-Define-section-attributes-for-clang.patch
deleted file mode 100644
index 54fbe5419..000000000
--- a/recipes-security/optee-imx/optee-os/0001-core-Define-section-attributes-for-clang.patch
+++ /dev/null
@@ -1,245 +0,0 @@
1From ef83625c9a5f50610e25aa860c4b9c5e64723a66 Mon Sep 17 00:00:00 2001
2From: Emekcan Aras <emekcan.aras@arm.com>
3Date: Wed, 21 Dec 2022 10:55:58 +0000
4Subject: [PATCH 1/4] core: Define section attributes for clang
5
6Clang's attribute section is not same as gcc, here we need to add flags
7to sections so they can be eventually collected by linker into final
8output segments. Only way to do so with clang is to use
9
10pragma clang section ...
11
12The behavious is described here [1], this allows us to define names bss
13sections. This was not an issue until clang-15 where LLD linker starts
14to detect the section flags before merging them and throws the following
15errors
16
17| ld.lld: error: section type mismatch for .nozi.kdata_page
18| >>> /mnt/b/yoe/master/build/tmp/work/qemuarm64-yoe-linux/optee-os-tadevkit/3.17.0-r0/build/core/arch/arm/kernel/thread.o:(.nozi.kdata_page): SHT_PROGBITS
19| >>> output section .nozi: SHT_NOBITS
20|
21| ld.lld: error: section type mismatch for .nozi.mmu.l2
22| >>> /mnt/b/yoe/master/build/tmp/work/qemuarm64-yoe-linux/optee-os-tadevkit/3.17.0-r0/build/core/arch/arm/mm/core_mmu_lpae.o:(.nozi.mmu.l2): SHT_PROGBITS
23| >>> output section .nozi: SHT_NOBITS
24
25These sections should be carrying SHT_NOBITS but so far it was not
26possible to do so, this patch tries to use clangs pragma to get this
27going and match the functionality with gcc.
28
29[1] https://intel.github.io/llvm-docs/clang/LanguageExtensions.html#specifying-section-names-for-global-objects-pragma-clang-section
30
31Upstream-Status: Pending
32Signed-off-by: Khem Raj <raj.khem@gmail.com>
33Signed-off-by: Oleksandr Suvorov <oleksandr.suvorov@foundries.io>
34---
35
36 core/arch/arm/kernel/thread.c | 19 +++++++++++++++--
37 core/arch/arm/mm/core_mmu_lpae.c | 35 +++++++++++++++++++++++++++----
38 core/arch/arm/mm/core_mmu_v7.c | 36 +++++++++++++++++++++++++++++---
39 core/kernel/thread.c | 13 +++++++++++-
40 core/mm/pgt_cache.c | 12 ++++++++++-
41 5 files changed, 104 insertions(+), 11 deletions(-)
42
43diff --git a/core/arch/arm/kernel/thread.c b/core/arch/arm/kernel/thread.c
44index 66833b3a0..b3eb9cf9a 100644
45--- a/core/arch/arm/kernel/thread.c
46+++ b/core/arch/arm/kernel/thread.c
47@@ -45,15 +45,30 @@ static size_t thread_user_kcode_size __nex_bss;
48 #if defined(CFG_CORE_UNMAP_CORE_AT_EL0) && \
49 defined(CFG_CORE_WORKAROUND_SPECTRE_BP_SEC) && defined(ARM64)
50 long thread_user_kdata_sp_offset __nex_bss;
51+#ifdef __clang__
52+#ifndef CFG_VIRTUALIZATION
53+#pragma clang section bss=".nozi.kdata_page"
54+#else
55+#pragma clang section bss=".nex_nozi.kdata_page"
56+#endif
57+#endif
58 static uint8_t thread_user_kdata_page[
59 ROUNDUP(sizeof(struct thread_core_local) * CFG_TEE_CORE_NB_CORE,
60 SMALL_PAGE_SIZE)]
61 __aligned(SMALL_PAGE_SIZE)
62+#ifndef __clang__
63 #ifndef CFG_NS_VIRTUALIZATION
64- __section(".nozi.kdata_page");
65+ __section(".nozi.kdata_page")
66 #else
67- __section(".nex_nozi.kdata_page");
68+ __section(".nex_nozi.kdata_page")
69 #endif
70+#endif
71+ ;
72+#endif
73+
74+/* reset BSS section to default ( .bss ) */
75+#ifdef __clang__
76+#pragma clang section bss=""
77 #endif
78
79 #ifdef ARM32
80diff --git a/core/arch/arm/mm/core_mmu_lpae.c b/core/arch/arm/mm/core_mmu_lpae.c
81index 4c8b85e39..1885e1d3f 100644
82--- a/core/arch/arm/mm/core_mmu_lpae.c
83+++ b/core/arch/arm/mm/core_mmu_lpae.c
84@@ -234,19 +234,46 @@ typedef uint16_t l1_idx_t;
85 typedef uint64_t base_xlat_tbls_t[CFG_TEE_CORE_NB_CORE][NUM_BASE_LEVEL_ENTRIES];
86 typedef uint64_t xlat_tbl_t[XLAT_TABLE_ENTRIES];
87
88+#ifdef __clang__
89+#pragma clang section bss=".nozi.mmu.base_table"
90+#endif
91 static base_xlat_tbls_t base_xlation_table[NUM_BASE_TABLES]
92 __aligned(NUM_BASE_LEVEL_ENTRIES * XLAT_ENTRY_SIZE)
93- __section(".nozi.mmu.base_table");
94+#ifndef __clang__
95+ __section(".nozi.mmu.base_table")
96+#endif
97+;
98+#ifdef __clang__
99+#pragma clang section bss=""
100+#endif
101
102+#ifdef __clang__
103+#pragma clang section bss=".nozi.mmu.l2"
104+#endif
105 static xlat_tbl_t xlat_tables[MAX_XLAT_TABLES]
106- __aligned(XLAT_TABLE_SIZE) __section(".nozi.mmu.l2");
107+ __aligned(XLAT_TABLE_SIZE)
108+#ifndef __clang__
109+ __section(".nozi.mmu.l2")
110+#endif
111+;
112+#ifdef __clang__
113+#pragma clang section bss=""
114+#endif
115
116 #define XLAT_TABLES_SIZE (sizeof(xlat_tbl_t) * MAX_XLAT_TABLES)
117
118+#ifdef __clang__
119+#pragma clang section bss=".nozi.mmu.l2"
120+#endif
121 /* MMU L2 table for TAs, one for each thread */
122 static xlat_tbl_t xlat_tables_ul1[CFG_NUM_THREADS]
123- __aligned(XLAT_TABLE_SIZE) __section(".nozi.mmu.l2");
124-
125+#ifndef __clang__
126+ __aligned(XLAT_TABLE_SIZE) __section(".nozi.mmu.l2")
127+#endif
128+;
129+#ifdef __clang__
130+#pragma clang section bss=""
131+#endif
132 /*
133 * TAs page table entry inside a level 1 page table.
134 *
135diff --git a/core/arch/arm/mm/core_mmu_v7.c b/core/arch/arm/mm/core_mmu_v7.c
136index 61e703da8..1960c08ca 100644
137--- a/core/arch/arm/mm/core_mmu_v7.c
138+++ b/core/arch/arm/mm/core_mmu_v7.c
139@@ -204,16 +204,46 @@ typedef uint32_t l1_xlat_tbl_t[NUM_L1_ENTRIES];
140 typedef uint32_t l2_xlat_tbl_t[NUM_L2_ENTRIES];
141 typedef uint32_t ul1_xlat_tbl_t[NUM_UL1_ENTRIES];
142
143+#ifdef __clang__
144+#pragma clang section bss=".nozi.mmu.l1"
145+#endif
146 static l1_xlat_tbl_t main_mmu_l1_ttb
147- __aligned(L1_ALIGNMENT) __section(".nozi.mmu.l1");
148+ __aligned(L1_ALIGNMENT)
149+#ifndef __clang__
150+ __section(".nozi.mmu.l1")
151+#endif
152+;
153+#ifdef __clang__
154+#pragma clang section bss=""
155+#endif
156
157 /* L2 MMU tables */
158+#ifdef __clang__
159+#pragma clang section bss=".nozi.mmu.l2"
160+#endif
161 static l2_xlat_tbl_t main_mmu_l2_ttb[MAX_XLAT_TABLES]
162- __aligned(L2_ALIGNMENT) __section(".nozi.mmu.l2");
163+ __aligned(L2_ALIGNMENT)
164+#ifndef __clang__
165+ __section(".nozi.mmu.l2")
166+#endif
167+;
168+#ifdef __clang__
169+#pragma clang section bss=""
170+#endif
171
172 /* MMU L1 table for TAs, one for each thread */
173+#ifdef __clang__
174+#pragma clang section bss=".nozi.mmu.ul1"
175+#endif
176 static ul1_xlat_tbl_t main_mmu_ul1_ttb[CFG_NUM_THREADS]
177- __aligned(UL1_ALIGNMENT) __section(".nozi.mmu.ul1");
178+ __aligned(UL1_ALIGNMENT)
179+#ifndef __clang__
180+ __section(".nozi.mmu.ul1")
181+#endif
182+;
183+#ifdef __clang__
184+#pragma clang section bss=""
185+#endif
186
187 struct mmu_partition {
188 l1_xlat_tbl_t *l1_table;
189diff --git a/core/kernel/thread.c b/core/kernel/thread.c
190index 2a1f22dce..5516b6771 100644
191--- a/core/kernel/thread.c
192+++ b/core/kernel/thread.c
193@@ -39,13 +39,24 @@ static uint32_t end_canary_value = 0xababab00;
194 name[stack_num][sizeof(name[stack_num]) / sizeof(uint32_t) - 1]
195 #endif
196
197+#define DO_PRAGMA(x) _Pragma (#x)
198+
199+#ifdef __clang__
200+#define DECLARE_STACK(name, num_stacks, stack_size, linkage) \
201+DO_PRAGMA (clang section bss=".nozi_stack." #name) \
202+linkage uint32_t name[num_stacks] \
203+ [ROUNDUP(stack_size + STACK_CANARY_SIZE + STACK_CHECK_EXTRA, \
204+ STACK_ALIGNMENT) / sizeof(uint32_t)] \
205+ __attribute__((aligned(STACK_ALIGNMENT))); \
206+DO_PRAGMA(clang section bss="")
207+#else
208 #define DECLARE_STACK(name, num_stacks, stack_size, linkage) \
209 linkage uint32_t name[num_stacks] \
210 [ROUNDUP(stack_size + STACK_CANARY_SIZE + STACK_CHECK_EXTRA, \
211 STACK_ALIGNMENT) / sizeof(uint32_t)] \
212 __attribute__((section(".nozi_stack." # name), \
213 aligned(STACK_ALIGNMENT)))
214-
215+#endif
216 #define GET_STACK(stack) ((vaddr_t)(stack) + STACK_SIZE(stack))
217
218 DECLARE_STACK(stack_tmp, CFG_TEE_CORE_NB_CORE, STACK_TMP_SIZE,
219diff --git a/core/mm/pgt_cache.c b/core/mm/pgt_cache.c
220index 79553c6d2..b9efdf427 100644
221--- a/core/mm/pgt_cache.c
222+++ b/core/mm/pgt_cache.c
223@@ -410,8 +410,18 @@ void pgt_init(void)
224 * has a large alignment, while .bss has a small alignment. The current
225 * link script is optimized for small alignment in .bss
226 */
227+#ifdef __clang__
228+#pragma clang section bss=".nozi.mmu.l2"
229+#endif
230 static uint8_t pgt_tables[PGT_CACHE_SIZE][PGT_SIZE]
231- __aligned(PGT_SIZE) __section(".nozi.pgt_cache");
232+ __aligned(PGT_SIZE)
233+#ifndef __clang__
234+ __section(".nozi.pgt_cache")
235+#endif
236+ ;
237+#ifdef __clang__
238+#pragma clang section bss=""
239+#endif
240 size_t n;
241
242 for (n = 0; n < ARRAY_SIZE(pgt_tables); n++) {
243--
2442.43.2
245
diff --git a/recipes-security/optee-imx/optee-os/0003-arm32-libutils-libutee-ta-add-.note.GNU-stack-sectio.patch b/recipes-security/optee-imx/optee-os/0003-arm32-libutils-libutee-ta-add-.note.GNU-stack-sectio.patch
deleted file mode 100644
index 1c5753c7f..000000000
--- a/recipes-security/optee-imx/optee-os/0003-arm32-libutils-libutee-ta-add-.note.GNU-stack-sectio.patch
+++ /dev/null
@@ -1,133 +0,0 @@
1From 6f738803a59613ec4a683ddbc1747ebffd75a4e6 Mon Sep 17 00:00:00 2001
2From: Jerome Forissier <jerome.forissier@linaro.org>
3Date: Tue, 23 Aug 2022 12:31:46 +0000
4Subject: [PATCH 3/4] arm32: libutils, libutee, ta: add .note.GNU-stack section
5 to
6
7 .S files
8
9When building for arm32 with GNU binutils 2.39, the linker outputs
10warnings when linking Trusted Applications:
11
12 arm-unknown-linux-uclibcgnueabihf-ld.bfd: warning: utee_syscalls_a32.o: missing .note.GNU-stack section implies executable stack
13 arm-unknown-linux-uclibcgnueabihf-ld.bfd: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
14
15We could silence the warning by adding the '-z execstack' option to the
16TA link flags, like we did in the parent commit for the TEE core and
17ldelf. Indeed, ldelf always allocates a non-executable piece of memory
18for the TA to use as a stack.
19
20However it seems preferable to comply with the common ELF practices in
21this case. A better fix is therefore to add the missing .note.GNU-stack
22sections in the assembler files.
23
24Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
25
26Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
27Upstream-Status: Backport [https://github.com/OP-TEE/optee_os/pull/5499]
28Signed-off-by: Oleksandr Suvorov <oleksandr.suvorov@foundries.io>
29---
30
31 lib/libutee/arch/arm/utee_syscalls_a32.S | 2 ++
32 lib/libutils/ext/arch/arm/atomic_a32.S | 2 ++
33 lib/libutils/ext/arch/arm/mcount_a32.S | 2 ++
34 lib/libutils/isoc/arch/arm/arm32_aeabi_divmod_a32.S | 2 ++
35 lib/libutils/isoc/arch/arm/arm32_aeabi_ldivmod_a32.S | 2 ++
36 lib/libutils/isoc/arch/arm/setjmp_a32.S | 2 ++
37 ta/arch/arm/ta_entry_a32.S | 2 ++
38 7 files changed, 14 insertions(+)
39
40diff --git a/lib/libutee/arch/arm/utee_syscalls_a32.S b/lib/libutee/arch/arm/utee_syscalls_a32.S
41index 2dea83ab8..668b65a86 100644
42--- a/lib/libutee/arch/arm/utee_syscalls_a32.S
43+++ b/lib/libutee/arch/arm/utee_syscalls_a32.S
44@@ -9,6 +9,8 @@
45
46 .section .note.GNU-stack,"",%progbits
47
48+ .section .note.GNU-stack,"",%progbits
49+
50 .section .text
51 .balign 4
52 .code 32
53diff --git a/lib/libutils/ext/arch/arm/atomic_a32.S b/lib/libutils/ext/arch/arm/atomic_a32.S
54index 2be73ffad..87ddf1065 100644
55--- a/lib/libutils/ext/arch/arm/atomic_a32.S
56+++ b/lib/libutils/ext/arch/arm/atomic_a32.S
57@@ -7,6 +7,8 @@
58
59 .section .note.GNU-stack,"",%progbits
60
61+ .section .note.GNU-stack,"",%progbits
62+
63 /* uint32_t atomic_inc32(uint32_t *v); */
64 FUNC atomic_inc32 , :
65 ldrex r1, [r0]
66diff --git a/lib/libutils/ext/arch/arm/mcount_a32.S b/lib/libutils/ext/arch/arm/mcount_a32.S
67index 54dc3c02d..2f24632b8 100644
68--- a/lib/libutils/ext/arch/arm/mcount_a32.S
69+++ b/lib/libutils/ext/arch/arm/mcount_a32.S
70@@ -9,6 +9,8 @@
71
72 .section .note.GNU-stack,"",%progbits
73
74+ .section .note.GNU-stack,"",%progbits
75+
76 /*
77 * Convert return address to call site address by subtracting the size of the
78 * mcount call instruction (blx __gnu_mcount_nc).
79diff --git a/lib/libutils/isoc/arch/arm/arm32_aeabi_divmod_a32.S b/lib/libutils/isoc/arch/arm/arm32_aeabi_divmod_a32.S
80index 37ae9ec6f..bc6c48b1a 100644
81--- a/lib/libutils/isoc/arch/arm/arm32_aeabi_divmod_a32.S
82+++ b/lib/libutils/isoc/arch/arm/arm32_aeabi_divmod_a32.S
83@@ -7,6 +7,8 @@
84
85 .section .note.GNU-stack,"",%progbits
86
87+ .section .note.GNU-stack,"",%progbits
88+
89 /*
90 * signed ret_idivmod_values(signed quot, signed rem);
91 * return quotient and remaining the EABI way (regs r0,r1)
92diff --git a/lib/libutils/isoc/arch/arm/arm32_aeabi_ldivmod_a32.S b/lib/libutils/isoc/arch/arm/arm32_aeabi_ldivmod_a32.S
93index 5c3353e2c..9fb5e0283 100644
94--- a/lib/libutils/isoc/arch/arm/arm32_aeabi_ldivmod_a32.S
95+++ b/lib/libutils/isoc/arch/arm/arm32_aeabi_ldivmod_a32.S
96@@ -7,6 +7,8 @@
97
98 .section .note.GNU-stack,"",%progbits
99
100+ .section .note.GNU-stack,"",%progbits
101+
102 /*
103 * __value_in_regs lldiv_t __aeabi_ldivmod( long long n, long long d)
104 */
105diff --git a/lib/libutils/isoc/arch/arm/setjmp_a32.S b/lib/libutils/isoc/arch/arm/setjmp_a32.S
106index f8a0b70df..37d7cb88e 100644
107--- a/lib/libutils/isoc/arch/arm/setjmp_a32.S
108+++ b/lib/libutils/isoc/arch/arm/setjmp_a32.S
109@@ -53,6 +53,8 @@
110
111 .section .note.GNU-stack,"",%progbits
112
113+ .section .note.GNU-stack,"",%progbits
114+
115 /* Arm/Thumb interworking support:
116
117 The interworking scheme expects functions to use a BX instruction
118diff --git a/ta/arch/arm/ta_entry_a32.S b/ta/arch/arm/ta_entry_a32.S
119index cd9a12f9d..ccdc19928 100644
120--- a/ta/arch/arm/ta_entry_a32.S
121+++ b/ta/arch/arm/ta_entry_a32.S
122@@ -7,6 +7,8 @@
123
124 .section .note.GNU-stack,"",%progbits
125
126+ .section .note.GNU-stack,"",%progbits
127+
128 /*
129 * This function is the bottom of the user call stack. Mark it as such so that
130 * the unwinding code won't try to go further down.
131--
1322.43.2
133
diff --git a/recipes-security/optee-imx/optee-os/0004-core-link-add-no-warn-rwx-segments.patch b/recipes-security/optee-imx/optee-os/0004-core-link-add-no-warn-rwx-segments.patch
deleted file mode 100644
index f32b2284f..000000000
--- a/recipes-security/optee-imx/optee-os/0004-core-link-add-no-warn-rwx-segments.patch
+++ /dev/null
@@ -1,67 +0,0 @@
1From a63f82f74e015eb662242cdb51ef814e3f576829 Mon Sep 17 00:00:00 2001
2From: Jerome Forissier <jerome.forissier@linaro.org>
3Date: Fri, 5 Aug 2022 09:48:03 +0200
4Subject: [PATCH 4/4] core: link: add --no-warn-rwx-segments
5
6Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
7Upstream-Status: Backport [https://github.com/OP-TEE/optee_os/pull/5474]
8
9binutils ld.bfd generates one RWX LOAD segment by merging several sections
10with mixed R/W/X attributes (.text, .rodata, .data). After version 2.38 it
11also warns by default when that happens [1], which breaks the build due to
12--fatal-warnings. The RWX segment is not a problem for the TEE core, since
13that information is not used to set memory permissions. Therefore, silence
14the warning.
15
16Link: [1] https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107
17Link: https://sourceware.org/bugzilla/show_bug.cgi?id=29448
18Reported-by: Dominique Martinet <dominique.martinet@atmark-techno.com>
19Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
20Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
21Signed-off-by: Oleksandr Suvorov <oleksandr.suvorov@foundries.io>
22---
23
24 core/arch/arm/kernel/link.mk | 6 ++++--
25 1 file changed, 4 insertions(+), 2 deletions(-)
26
27diff --git a/core/arch/arm/kernel/link.mk b/core/arch/arm/kernel/link.mk
28index 49e9f4fa1..9e1cc172f 100644
29--- a/core/arch/arm/kernel/link.mk
30+++ b/core/arch/arm/kernel/link.mk
31@@ -37,6 +37,7 @@ link-ldflags += --sort-section=alignment
32 link-ldflags += --fatal-warnings
33 link-ldflags += --gc-sections
34 link-ldflags += $(link-ldflags-common)
35+link-ldflags += $(call ld-option,--no-warn-rwx-segments)
36
37 link-ldadd = $(LDADD)
38 link-ldadd += $(ldflags-external)
39@@ -61,6 +62,7 @@ link-script-cppflags := \
40 $(cppflagscore))
41
42 ldargs-all_objs := -T $(link-script-dummy) --no-check-sections \
43+ $(call ld-option,--no-warn-rwx-segments) \
44 $(link-ldflags-common) \
45 $(link-objs) $(link-ldadd) $(libgcccore)
46 cleanfiles += $(link-out-dir)/all_objs.o
47@@ -75,7 +77,7 @@ $(link-out-dir)/unpaged_entries.txt: $(link-out-dir)/all_objs.o
48 $(AWK) '/ ____keep_pager/ { printf "-u%s ", $$3 }' > $@
49
50 unpaged-ldargs := -T $(link-script-dummy) --no-check-sections --gc-sections \
51- $(link-ldflags-common)
52+ $(link-ldflags-common) $(call ld-option,--no-warn-rwx-segments)
53 unpaged-ldadd := $(objs) $(link-ldadd) $(libgcccore)
54 cleanfiles += $(link-out-dir)/unpaged.o
55 $(link-out-dir)/unpaged.o: $(link-out-dir)/unpaged_entries.txt
56@@ -104,7 +106,7 @@ $(link-out-dir)/init_entries.txt: $(link-out-dir)/all_objs.o
57 $(AWK) '/ ____keep_init/ { printf "-u%s ", $$3 }' > $@
58
59 init-ldargs := -T $(link-script-dummy) --no-check-sections --gc-sections \
60- $(link-ldflags-common)
61+ $(link-ldflags-common) $(call ld-option,--no-warn-rwx-segments)
62 init-ldadd := $(link-objs-init) $(link-out-dir)/version.o $(link-ldadd) \
63 $(libgcccore)
64 cleanfiles += $(link-out-dir)/init.o
65--
662.43.2
67
diff --git a/recipes-security/optee-imx/optee-os/0002-optee-enable-clang-support.patch b/recipes-security/optee-imx/optee-os/0007-allow-setting-sysroot-for-clang.patch
index dbc53542e..067ba6ebf 100644
--- a/recipes-security/optee-imx/optee-os/0002-optee-enable-clang-support.patch
+++ b/recipes-security/optee-imx/optee-os/0007-allow-setting-sysroot-for-clang.patch
@@ -1,7 +1,7 @@
1From 2ba573c9763329fbfdfacc8393d565ab747cac4d Mon Sep 17 00:00:00 2001 1From db9e44af75c7cfd3316cab15aaa387383df3e57e Mon Sep 17 00:00:00 2001
2From: Brett Warren <brett.warren@arm.com> 2From: Brett Warren <brett.warren@arm.com>
3Date: Wed, 23 Sep 2020 09:27:34 +0100 3Date: Wed, 23 Sep 2020 09:27:34 +0100
4Subject: [PATCH 2/4] optee: enable clang support 4Subject: [PATCH] optee: enable clang support
5 5
6When compiling with clang, the LIBGCC_LOCATE_CFLAG variable used 6When compiling with clang, the LIBGCC_LOCATE_CFLAG variable used
7to provide a sysroot wasn't included, which results in not locating 7to provide a sysroot wasn't included, which results in not locating
@@ -10,17 +10,16 @@ compiler-rt. This is mitigated by including the variable as ammended.
10Upstream-Status: Pending 10Upstream-Status: Pending
11ChangeId: 8ba69a4b2eb8ebaa047cb266c9aa6c2c3da45701 11ChangeId: 8ba69a4b2eb8ebaa047cb266c9aa6c2c3da45701
12Signed-off-by: Brett Warren <brett.warren@arm.com> 12Signed-off-by: Brett Warren <brett.warren@arm.com>
13Signed-off-by: Oleksandr Suvorov <oleksandr.suvorov@foundries.io>
14---
15 13
14---
16 mk/clang.mk | 2 +- 15 mk/clang.mk | 2 +-
17 1 file changed, 1 insertion(+), 1 deletion(-) 16 1 file changed, 1 insertion(+), 1 deletion(-)
18 17
19diff --git a/mk/clang.mk b/mk/clang.mk 18diff --git a/mk/clang.mk b/mk/clang.mk
20index a045beee8..1ebe2f702 100644 19index c141a3f2..7d067cc0 100644
21--- a/mk/clang.mk 20--- a/mk/clang.mk
22+++ b/mk/clang.mk 21+++ b/mk/clang.mk
23@@ -30,7 +30,7 @@ comp-cflags-warns-clang := -Wno-language-extension-token \ 22@@ -27,7 +27,7 @@ comp-cflags-warns-clang := -Wno-language-extension-token \
24 23
25 # Note, use the compiler runtime library (libclang_rt.builtins.*.a) instead of 24 # Note, use the compiler runtime library (libclang_rt.builtins.*.a) instead of
26 # libgcc for clang 25 # libgcc for clang
@@ -29,6 +28,3 @@ index a045beee8..1ebe2f702 100644
29 -rtlib=compiler-rt -print-libgcc-file-name 2> /dev/null) 28 -rtlib=compiler-rt -print-libgcc-file-name 2> /dev/null)
30 29
31 # Core ASLR relies on the executable being ready to run from its preferred load 30 # Core ASLR relies on the executable being ready to run from its preferred load
32--
332.43.2
34
diff --git a/recipes-security/optee-imx/optee-os_4.2.0.imx.bb b/recipes-security/optee-imx/optee-os_4.2.0.imx.bb
deleted file mode 100644
index 96948bc7b..000000000
--- a/recipes-security/optee-imx/optee-os_4.2.0.imx.bb
+++ /dev/null
@@ -1,12 +0,0 @@
1# Copyright 2017-2024 NXP
2
3require optee-os-fslc-imx.inc
4
5SRC_URI += " \
6 file://0001-core-Define-section-attributes-for-clang.patch \
7 file://0002-optee-enable-clang-support.patch \
8 file://0003-arm32-libutils-libutee-ta-add-.note.GNU-stack-sectio.patch \
9 file://0004-core-link-add-no-warn-rwx-segments.patch \
10"
11SRCBRANCH = "lf-6.6.23_2.0.0"
12SRCREV = "c6be5b572452a2808d1a34588fd10e71715e23cf"
diff --git a/recipes-security/optee-imx/optee-os_4.6.0.imx.bb b/recipes-security/optee-imx/optee-os_4.6.0.imx.bb
new file mode 100644
index 000000000..ed2557bcb
--- /dev/null
+++ b/recipes-security/optee-imx/optee-os_4.6.0.imx.bb
@@ -0,0 +1,6 @@
1# Copyright 2017-2024 NXP
2
3require optee-os-fslc-imx.inc
4
5SRCBRANCH = "lf-6.12.20_2.0.0"
6SRCREV = "87964807d80baf1dcfd89cafc66de34a1cf16bf3"
diff --git a/recipes-security/optee-imx/optee-test-fslc-imx.inc b/recipes-security/optee-imx/optee-test-fslc-imx.inc
new file mode 100644
index 000000000..b4bb6031b
--- /dev/null
+++ b/recipes-security/optee-imx/optee-test-fslc-imx.inc
@@ -0,0 +1,18 @@
1# Copied from meta-imx/meta-imx-bsp/recipes-security/optee/optee-test-imx.inc.
2# See: https://github.com/nxp-imx/imx-manifest/blob/imx-linux-walnascar/imx-6.12.20-2.0.0.xml#L37
3require optee-test-fslc.inc
4
5DEPENDS += "openssl"
6
7FILESEXTRAPATHS:prepend := "${THISDIR}/optee-test:"
8
9SRC_URI:remove = "git://github.com/OP-TEE/optee_test.git;branch=master;protocol=https"
10SRC_URI:prepend = "${OPTEE_TEST_SRC};branch=${SRCBRANCH} "
11
12OPTEE_TEST_SRC ?= "git://github.com/nxp-imx/imx-optee-test.git;protocol=https"
13
14EXTRA_OEMAKE:append:libc-musl = " OPTEE_OPENSSL_EXPORT=${STAGING_INCDIR}"
15CFLAGS:append:libc-musl = " -Wno-error=deprecated-declarations"
16CFLAGS += " -Wno-error=unterminated-string-initialization"
17
18COMPATIBLE_MACHINE = "(imx-nxp-bsp)"
diff --git a/recipes-security/optee-imx/optee-test-fslc.inc b/recipes-security/optee-imx/optee-test-fslc.inc
index e0c133a7c..46d57ac41 100644
--- a/recipes-security/optee-imx/optee-test-fslc.inc
+++ b/recipes-security/optee-imx/optee-test-fslc.inc
@@ -1,38 +1,63 @@
1# Copyright (C) 2017-2021 NXP 1# Copied from meta-arm/recipes-security/optee/optee-test.inc.
2# See:https://github.com/nxp-imx/imx-manifest/blob/imx-linux-walnascar/imx-6.12.20-2.0.0.xml#L30
3
4SUMMARY = "OP-TEE sanity testsuite"
5DESCRIPTION = "Open Portable Trusted Execution Environment - Test suite"
6HOMEPAGE = "https://www.op-tee.org/"
2 7
3SUMMARY = "OPTEE test"
4LICENSE = "BSD-2-Clause & GPL-2.0-only" 8LICENSE = "BSD-2-Clause & GPL-2.0-only"
5LIC_FILES_CHKSUM = "file://LICENSE.md;md5=daa2bcccc666345ab8940aab1315a4fa"
6 9
10inherit python3native ptest
11inherit deploy
7require optee-fslc.inc 12require optee-fslc.inc
8 13
9DEPENDS += "optee-os optee-client openssl" 14DEPENDS = "optee-client optee-os-tadevkit python3-cryptography-native openssl"
15
16SRC_URI = "git://github.com/OP-TEE/optee_test.git;branch=master;protocol=https \
17 file://run-ptest \
18 "
19
20B = "${WORKDIR}/build"
21
22EXTRA_OEMAKE += "TA_DEV_KIT_DIR=${TA_DEV_KIT_DIR} \
23 OPTEE_OPENSSL_EXPORT=${STAGING_INCDIR} \
24 CROSS_COMPILE_HOST=${HOST_PREFIX} \
25 CROSS_COMPILE_TA=${HOST_PREFIX} \
26 O=${B} \
27 "
10 28
11EXTRA_OEMAKE += " \ 29CFLAGS += "-Wno-error=deprecated-declarations"
12 TA_DEV_KIT_DIR=${STAGING_INCDIR}/optee/export-user_ta_${OPTEE_ARCH}/ \
13 CROSS_COMPILE_HOST=${HOST_PREFIX} \
14 CROSS_COMPILE_TA=${HOST_PREFIX} \
15 CROSS_COMPILE=${HOST_PREFIX} \
16"
17 30
18do_compile() { 31do_compile() {
19 oe_runmake all 32 cd ${S}
33 # Top level makefile doesn't seem to handle parallel make gracefully
34 oe_runmake xtest
35 oe_runmake ta
36 oe_runmake test_plugin
20} 37}
21do_compile[cleandirs] = "${B}" 38do_compile[cleandirs] = "${B}"
22 39
23do_install () { 40do_install () {
24 install -d ${D}${bindir} 41 install -D -p -m0755 ${B}/xtest/xtest ${D}${bindir}/xtest
25 install ${B}/xtest/xtest ${D}${bindir} 42
26 43 # install path should match the value set in optee-client/tee-supplicant
27 install -d ${D}${nonarch_base_libdir}/optee_armtz 44 # default TEEC_LOAD_PATH is /lib
28 find ${B}/ta -name '*.ta' | while read name; do 45 mkdir -p ${D}${nonarch_base_libdir}/optee_armtz/
29 install -m 444 $name ${D}${nonarch_base_libdir}/optee_armtz/ 46 install -D -p -m0444 ${B}/ta/*/*.ta ${D}${nonarch_base_libdir}/optee_armtz/
30 done 47 mkdir -p ${D}${libdir}/tee-supplicant/plugins
48 install -D -p -m0444 ${B}/supp_plugin/*.plugin ${D}${libdir}/tee-supplicant/plugins/
49}
31 50
32 install -d ${D}${libdir}/tee-supplicant/plugins/ 51do_deploy () {
33 install ${B}/supp_plugin/*plugin ${D}${libdir}/tee-supplicant/plugins/ 52 install -d ${DEPLOYDIR}/${MLPREFIX}optee/ta
53 install -m 644 ${B}/ta/*/*.elf ${DEPLOYDIR}/${MLPREFIX}optee/ta
34} 54}
35 55
36FILES:${PN} += "${nonarch_base_libdir}/optee_armtz/ ${libdir}/tee-supplicant/plugins/" 56addtask deploy before do_build after do_install
57
58FILES:${PN} += "${nonarch_base_libdir}/optee_armtz/ \
59 ${libdir}/tee-supplicant/plugins/ \
60 "
37 61
38RDEPENDS:${PN} = "optee-os" 62# Imports machine specific configs from staging to build
63PACKAGE_ARCH = "${MACHINE_ARCH}"
diff --git a/recipes-security/optee-imx/optee-test/run-ptest b/recipes-security/optee-imx/optee-test/run-ptest
new file mode 100644
index 000000000..ba88c14d3
--- /dev/null
+++ b/recipes-security/optee-imx/optee-test/run-ptest
@@ -0,0 +1,52 @@
1#!/bin/sh
2xtest | awk '
3
4 # Escapes the special characters in a string so that, when
5 # included in a regex, it represents a literal match
6 function regx_escape_literal(str, ret) {
7 ret = str
8 gsub(/[\[\]\^\$\.\*\?\+\{\}\\\(\)\|]/ , "\\\\&", str)
9 return str
10 }
11
12 # Returns the simple test formatted name
13 function name(n, ret) {
14 ret = n
15 gsub(/\./, " ", ret)
16 return ret
17 }
18
19 # Returns the simple test formatted result
20 function result(res) {
21 if(res ~ /OK/) {
22 return "PASS"
23 } else if(res ~ /FAILED/) {
24 return "FAIL"
25 }
26 }
27
28 function parse(name, description, has_subtests, result_line) {
29 has_subtests = 0
30
31 # Consume every line up to the result line
32 result_line = " " regx_escape_literal(name) " (OK|FAILED)"
33 do {
34 getline
35
36 # If this is a subtest (denoted by an "o" bullet) then subparse
37 if($0 ~ /^o /) {
38 parse($2, description " : " substr($0, index($0, $3)))
39 has_subtests = 1
40 }
41 } while ($0 !~ result_line)
42
43 # Only print the results for the deepest nested subtests
44 if(!has_subtests) {
45 print result($2) ": " name(name) " - " description
46 }
47 }
48
49 # Start parsing at the beginning of every test (denoted by a "*" bullet)
50 /^\* / { parse($2, substr($0, index($0, $3))) }
51
52'
diff --git a/recipes-security/optee-imx/optee-test_4.2.0.imx.bb b/recipes-security/optee-imx/optee-test_4.2.0.imx.bb
deleted file mode 100644
index aa8444fba..000000000
--- a/recipes-security/optee-imx/optee-test_4.2.0.imx.bb
+++ /dev/null
@@ -1,10 +0,0 @@
1# Copyright 2017-2024 NXP
2
3require optee-test-fslc.inc
4
5SRC_URI = "git://github.com/nxp-imx/imx-optee-test.git;protocol=https;branch=${SRCBRANCH}"
6
7SRCBRANCH = "lf-6.6.23_2.0.0"
8SRCREV = "07682f1b1b41ec0bfa507286979b36ab8d344a96"
9
10COMPATIBLE_MACHINE = "(imx-nxp-bsp)"
diff --git a/recipes-security/optee-imx/optee-test_4.6.0.imx.bb b/recipes-security/optee-imx/optee-test_4.6.0.imx.bb
new file mode 100644
index 000000000..78e933486
--- /dev/null
+++ b/recipes-security/optee-imx/optee-test_4.6.0.imx.bb
@@ -0,0 +1,13 @@
1# Copyright 2017-2024 NXP
2
3require optee-test-fslc-imx.inc
4
5# The BSD and GPL license files are now included in the source
6# https://github.com/OP-TEE/optee_test/commit/a748f5fcd9ec8a574dc86a5aa56d05bc6ac174e7
7LIC_FILES_CHKSUM = "file://LICENSE.md;md5=a8fa504109e4cd7ea575bc49ea4be560 \
8 file://LICENSE-BSD;md5=dca16d6efa93b55d0fd662ae5cd6feeb \
9 file://LICENSE-GPL;md5=10e86b5d2a6cb0e2b9dcfdd26a9ac58d"
10
11
12SRCBRANCH = "lf-6.12.20_2.0.0"
13SRCREV = "010f088f05b5ebf392c6e235d6e53d391755722f"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-10-16 22:00:30 +0000