From eef28c83d4dcb9872e42bf35c533fef43e8e9b71 Mon Sep 17 00:00:00 2001 From: Rajdeep Bora Date: Wed, 22 Apr 2026 16:24:45 +0530 Subject: [PATCH] fscryptctl: add recipe for enabling File-based Encryption (FBE) - Kernel configs for fscrypt enabled - Added recipe changes for userpsace utility tool fscryptctl - Ported OP-TEE v4.4.0 for key management using Trusted Keys TA - Added TA-side and CA-side patches for successful filesystem encryption --- conf/machine/raspberrypi3-64.conf | 3 + recipes-bsp/bootfiles/rpi-config_git.bb | 15 +- recipes-bsp/optee/optee-client.inc | 48 ++ .../optee/optee-client/tee-supplicant.service | 10 + .../optee/optee-client/tee-supplicant.sh | 46 ++ recipes-bsp/optee/optee-client_4.4.0.bb | 20 + recipes-bsp/optee/optee-examples.inc | 46 ++ recipes-bsp/optee/optee-examples_4.4.0.bb | 22 + recipes-bsp/optee/optee-os-tadevkit_4.4.0.bb | 21 + recipes-bsp/optee/optee-os.inc | 77 ++++ ...TA-access-permission-and-change-uuid.patch | 32 ++ recipes-bsp/optee/optee-os_4.4.0.bb | 20 + recipes-bsp/optee/optee-test.inc | 64 +++ recipes-bsp/optee/optee-test/run-ptest | 52 +++ recipes-bsp/optee/optee-test_4.4.0.bb | 31 ++ recipes-bsp/optee/optee.inc | 32 ++ ...rpi3-pass-DTB-address-to-BL32-OP-TEE.patch | 42 ++ .../trusted-firmware-a/files/ssl.patch | 52 +++ .../trusted-firmware-a/trusted-firmware-a.inc | 246 ++++++++++ .../trusted-firmware-a_%.bbappend | 29 ++ .../trusted-firmware-a_2.7.bb | 58 +++ recipes-bsp/u-boot/files/myconfig.cfg | 287 ++++++++++++ recipes-bsp/u-boot/files/u-boot_rpi3_env | 37 ++ recipes-bsp/u-boot/u-boot_%.bbappend | 19 +- recipes-core/images/rpi-test-image.bb | 3 +- .../packagegroups/packagegroup-rpi-test.bb | 26 +- recipes-kernel/linux/files/fscypt.cfg | 28 ++ .../linux/files/optee_dtb_entry.patch | 15 + recipes-kernel/linux/files/tee-driver.cfg | 2 + .../linux/linux-raspberrypi_5.15.bb | 3 + ...rusted-keys-TA-access-from-userspace.patch | 426 ++++++++++++++++++ .../fscryptctl/fscryptctl_1.3.0.bb | 33 ++ 32 files changed, 1818 insertions(+), 27 deletions(-) create mode 100644 recipes-bsp/optee/optee-client.inc create mode 100644 recipes-bsp/optee/optee-client/tee-supplicant.service create mode 100644 recipes-bsp/optee/optee-client/tee-supplicant.sh create mode 100644 recipes-bsp/optee/optee-client_4.4.0.bb create mode 100644 recipes-bsp/optee/optee-examples.inc create mode 100644 recipes-bsp/optee/optee-examples_4.4.0.bb create mode 100644 recipes-bsp/optee/optee-os-tadevkit_4.4.0.bb create mode 100644 recipes-bsp/optee/optee-os.inc create mode 100644 recipes-bsp/optee/optee-os/0001-remove-TA-access-permission-and-change-uuid.patch create mode 100644 recipes-bsp/optee/optee-os_4.4.0.bb create mode 100644 recipes-bsp/optee/optee-test.inc create mode 100644 recipes-bsp/optee/optee-test/run-ptest create mode 100644 recipes-bsp/optee/optee-test_4.4.0.bb create mode 100644 recipes-bsp/optee/optee.inc create mode 100644 recipes-bsp/trusted-firmware-a/files/0001-rpi3-pass-DTB-address-to-BL32-OP-TEE.patch create mode 100644 recipes-bsp/trusted-firmware-a/files/ssl.patch create mode 100644 recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc create mode 100644 recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend create mode 100644 recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.7.bb create mode 100644 recipes-bsp/u-boot/files/myconfig.cfg create mode 100644 recipes-bsp/u-boot/files/u-boot_rpi3_env create mode 100644 recipes-kernel/linux/files/fscypt.cfg create mode 100644 recipes-kernel/linux/files/optee_dtb_entry.patch create mode 100644 recipes-kernel/linux/files/tee-driver.cfg create mode 100644 recipes-security/fscryptctl/files/0001-support-trusted-keys-TA-access-from-userspace.patch create mode 100644 recipes-security/fscryptctl/fscryptctl_1.3.0.bb diff --git a/conf/machine/raspberrypi3-64.conf b/conf/machine/raspberrypi3-64.conf index ff22f489e..fb184a88a 100644 --- a/conf/machine/raspberrypi3-64.conf +++ b/conf/machine/raspberrypi3-64.conf @@ -34,3 +34,6 @@ KERNEL_BOOTCMD ?= "booti" VC4DTBO ?= "vc4-fkms-v3d" ARMSTUB ?= "armstub8.bin" + +# Ensure armstub is included so rpi-config writes armstub= into config.txt +MACHINE_FEATURES += " armstub" diff --git a/recipes-bsp/bootfiles/rpi-config_git.bb b/recipes-bsp/bootfiles/rpi-config_git.bb index 003cb1076..07ce4e56c 100644 --- a/recipes-bsp/bootfiles/rpi-config_git.bb +++ b/recipes-bsp/bootfiles/rpi-config_git.bb @@ -32,7 +32,7 @@ CAN_OSCILLATOR ?= "16000000" CAN0_INTERRUPT_PIN ?= "25" CAN1_INTERRUPT_PIN ?= "24" -ENABLE_UART ??= "" +ENABLE_UART = "1" WM8960="${@bb.utils.contains("MACHINE_FEATURES", "wm8960", "1", "0", d)}" @@ -308,11 +308,14 @@ do_deploy() { } do_deploy:append:raspberrypi3-64() { - echo "# have a properly sized image" >> $CONFIG - echo "disable_overscan=1" >> $CONFIG - - echo "# Enable audio (loads snd_bcm2835)" >> $CONFIG - echo "dtparam=audio=on" >> $CONFIG + echo "enable_uart=1" >> $CONFIG + echo "kernel_address=0x02000000" >> $CONFIG + echo "device_tree=bcm2710-rpi-3-b-plus.dtb" >> $CONFIG + echo "device_tree_address=0x01000000" >> $CONFIG + echo "cpu=armv8" >> $CONFIG + echo "smp=on" >> $CONFIG + echo "core_freq=250" >> $CONFIG + echo "core_freq_min=250" >> $CONFIG } do_deploy:append() { diff --git a/recipes-bsp/optee/optee-client.inc b/recipes-bsp/optee/optee-client.inc new file mode 100644 index 000000000..b6e9b7593 --- /dev/null +++ b/recipes-bsp/optee/optee-client.inc @@ -0,0 +1,48 @@ +SUMMARY = "OP-TEE Client API" +DESCRIPTION = "Open Portable Trusted Execution Environment - Normal World Client side of the TEE" +HOMEPAGE = "https://www.op-tee.org/" + +LICENSE = "BSD-2-Clause" +LIC_FILES_CHKSUM = "file://LICENSE;md5=69663ab153298557a59c67a60a743e5b" + +inherit systemd update-rc.d cmake +# inherit useradd + +# USERADD_PACKAGES = "${PN}" +# USERADD_PARAM:${PN} = "-r -g teesuppl -d /var/lib/tee -s /sbin/nologin teesuppl" +# GROUPADD_PARAM:${PN} = "-r teesuppl" + +FILESEXTRAPATHS:prepend := "${THISDIR}/optee-client:" + +SRC_URI = " \ + git://github.com/OP-TEE/optee_client.git;branch=master;protocol=https \ + file://tee-supplicant.service \ + file://tee-supplicant.sh \ +" + +UPSTREAM_CHECK_GITTAGREGEX = "^(?P\d+(\.\d+)+)$" + +S = "${WORKDIR}/git" + +EXTRA_OECMAKE = " \ + -DBUILD_SHARED_LIBS=ON \ + -DCFG_TEE_FS_PARENT_PATH='${localstatedir}/lib/tee' \ +" +EXTRA_OECMAKE:append:toolchain-clang = " -DCFG_WERROR=0" + +do_install:append() { + install -D -p -m0644 ${WORKDIR}/tee-supplicant.service ${D}${systemd_system_unitdir}/tee-supplicant.service + install -D -p -m0755 ${WORKDIR}/tee-supplicant.sh ${D}${sysconfdir}/init.d/tee-supplicant + + sed -i -e s:@sysconfdir@:${sysconfdir}:g \ + -e s:@sbindir@:${sbindir}:g \ + ${D}${systemd_system_unitdir}/tee-supplicant.service \ + ${D}${sysconfdir}/init.d/tee-supplicant +} + +SYSTEMD_SERVICE:${PN} = "tee-supplicant.service" + +INITSCRIPT_PACKAGES = "${PN}" +INITSCRIPT_NAME:${PN} = "tee-supplicant" +INITSCRIPT_PARAMS:${PN} = "start 10 1 2 3 4 5 . stop 90 0 6 ." + diff --git a/recipes-bsp/optee/optee-client/tee-supplicant.service b/recipes-bsp/optee/optee-client/tee-supplicant.service new file mode 100644 index 000000000..9a578e3af --- /dev/null +++ b/recipes-bsp/optee/optee-client/tee-supplicant.service @@ -0,0 +1,10 @@ +[Unit] +Description=TEE Supplicant + +[Service] +User=root +EnvironmentFile=-@sysconfdir@/default/tee-supplicant +ExecStart=@sbindir@/tee-supplicant $OPTARGS + +[Install] +WantedBy=basic.target \ No newline at end of file diff --git a/recipes-bsp/optee/optee-client/tee-supplicant.sh b/recipes-bsp/optee/optee-client/tee-supplicant.sh new file mode 100644 index 000000000..00fc2453b --- /dev/null +++ b/recipes-bsp/optee/optee-client/tee-supplicant.sh @@ -0,0 +1,46 @@ +#!/bin/sh + +# Source function library +. /etc/init.d/functions + +NAME=tee-supplicant +PATH=/sbin:/bin:/usr/sbin:/usr/bin +DESC="OP-TEE Supplicant" + +DAEMON=@sbindir@/$NAME + +test -f $DAEMON || exit 0 + +test -f @sysconfdir@/default/$NAME && . @sysconfdir@/default/$NAME +test -f @sysconfdir@/default/rcS && . @sysconfdir@/default/rcS + +SSD_OPTIONS="--oknodo --quiet --exec $DAEMON -- -d $OPTARGS" + +set -e + +case $1 in + start) + echo -n "Starting $DESC: " + start-stop-daemon --start $SSD_OPTIONS + echo "${DAEMON##*/}." + ;; + stop) + echo -n "Stopping $DESC: " + start-stop-daemon --stop $SSD_OPTIONS + echo "${DAEMON##*/}." + ;; + restart|force-reload) + $0 stop + sleep 1 + $0 start + ;; + status) + status ${DAEMON} || exit $? + ;; + *) + echo "Usage: $0 {start|stop|restart|force-reload|status}" >&2 + exit 1 + ;; +esac + +exit 0 \ No newline at end of file diff --git a/recipes-bsp/optee/optee-client_4.4.0.bb b/recipes-bsp/optee/optee-client_4.4.0.bb new file mode 100644 index 000000000..3f7d18d76 --- /dev/null +++ b/recipes-bsp/optee/optee-client_4.4.0.bb @@ -0,0 +1,20 @@ +require optee-client.inc + +SRCREV = "d221676a58b305bddbf97db00395205b3038de8e" +PLATFORM = "rpi3" + +inherit pkgconfig + +DEPENDS += "util-linux" +EXTRA_OEMAKE += "PKG_CONFIG=pkg-config" + +FILES:${PN} = " \ + /etc/init.d/tee-supplicant \ + /etc/udev/rules.d/optee-udev.rules \ + /lib/systemd/system/tee-supplicant.service \ + /usr/include/* \ + /usr/lib/* \ + /usr/lib/pkgconfig/* \ + /usr/lib/systemd/system/* \ + /usr/sbin/tee-supplicant \ + " \ No newline at end of file diff --git a/recipes-bsp/optee/optee-examples.inc b/recipes-bsp/optee/optee-examples.inc new file mode 100644 index 000000000..5011f4804 --- /dev/null +++ b/recipes-bsp/optee/optee-examples.inc @@ -0,0 +1,46 @@ +SUMMARY = "OP-TEE examples" +DESCRIPTION = "Open Portable Trusted Execution Environment - Sample Applications" +HOMEPAGE = "https://github.com/linaro-swg/optee_examples" + +LICENSE = "BSD-2-Clause" +LIC_FILES_CHKSUM = "file://LICENSE;md5=cd95ab417e23b94f381dafc453d70c30" + +DEPENDS = "optee-client optee-os-tadevkit python3-cryptography-native" + +inherit python3native + +require optee.inc + +SRC_URI = "git://github.com/linaro-swg/optee_examples.git;branch=master;protocol=https \ + " + +EXTRA_OEMAKE += "TA_DEV_KIT_DIR=${TA_DEV_KIT_DIR} \ + HOST_CROSS_COMPILE=${HOST_PREFIX} \ + TA_CROSS_COMPILE=${HOST_PREFIX} \ + OUTPUT_DIR=${B} \ + " + +S = "${WORKDIR}/git" +B = "${WORKDIR}/build" + + +do_compile() { + oe_runmake -C ${S} +} +do_compile[cleandirs] = "${B}" + +do_install () { + mkdir -p ${D}${nonarch_base_libdir}/optee_armtz + mkdir -p ${D}${bindir} + mkdir -p ${D}${libdir}/tee-supplicant/plugins + install -D -p -m0755 ${B}/ca/* ${D}${bindir} + install -D -p -m0444 ${B}/ta/* ${D}${nonarch_base_libdir}/optee_armtz + install -D -p -m0444 ${B}/plugins/* ${D}${libdir}/tee-supplicant/plugins +} + +FILES:${PN} += "${nonarch_base_libdir}/optee_armtz/ \ + ${libdir}/tee-supplicant/plugins/ \ + " + +# Imports machine specific configs from staging to build +PACKAGE_ARCH = "${MACHINE_ARCH}" diff --git a/recipes-bsp/optee/optee-examples_4.4.0.bb b/recipes-bsp/optee/optee-examples_4.4.0.bb new file mode 100644 index 000000000..bd51b6450 --- /dev/null +++ b/recipes-bsp/optee/optee-examples_4.4.0.bb @@ -0,0 +1,22 @@ +require optee-examples.inc + +SRCREV = "378dc0db2d5dd279f58a3b6cb3f78ffd6b165035" + +COMPATIBLE_MACHINE = "^rpi$" + +do_install:append(){ + install -d ${D}${base_libdir}/optee_armtz + install -m 0444 ${B}/ta/* ${D}${base_libdir}/optee_armtz + + install -d ${D}${bindir} + install -m 0744 ${B}/ta/* ${D}${bindir} + + install -d ${D}${libdir}/tee-supplicant/plugins + install -m 0444 ${B}/plugins/* ${D}${libdir}/tee-supplicant/plugins +} + +FILES:${PN} += " \ + ${base_libdir}/optee_armtz/* \ + ${bindir}/* \ + ${libdir}/tee-supplicant/plugins/* \ + " diff --git a/recipes-bsp/optee/optee-os-tadevkit_4.4.0.bb b/recipes-bsp/optee/optee-os-tadevkit_4.4.0.bb new file mode 100644 index 000000000..50f9a2bf5 --- /dev/null +++ b/recipes-bsp/optee/optee-os-tadevkit_4.4.0.bb @@ -0,0 +1,21 @@ +FILESEXTRAPATHS:prepend := "${THISDIR}/optee-os:" +require optee-os_4.4.0.bb + +SUMMARY = "OP-TEE Trusted OS TA devkit" +DESCRIPTION = "OP-TEE TA devkit for build TAs" +HOMEPAGE = "https://www.op-tee.org/" + + +do_install() { + #install TA devkit + install -d ${D}${includedir}/optee/export-user_ta/ + for f in ${B}/export-ta_${OPTEE_ARCH}/* ; do + cp -aR $f ${D}${includedir}/optee/export-user_ta/ + done +} + +do_deploy() { + echo "Do not inherit do_deploy from optee-os." +} + +FILES:${PN} = "${includedir}/optee/" \ No newline at end of file diff --git a/recipes-bsp/optee/optee-os.inc b/recipes-bsp/optee/optee-os.inc new file mode 100644 index 000000000..6921e42aa --- /dev/null +++ b/recipes-bsp/optee/optee-os.inc @@ -0,0 +1,77 @@ +SUMMARY = "OP-TEE Trusted OS" +DESCRIPTION = "Open Portable Trusted Execution Environment - Trusted side of the TEE" +HOMEPAGE = "https://www.op-tee.org/" + +LICENSE = "BSD-2-Clause" +LIC_FILES_CHKSUM = "file://LICENSE;md5=c1f21c4f72f372ef38a5a4aee55ec173" + +inherit deploy python3native +require optee.inc + +CVE_PRODUCT = "linaro:op-tee op-tee:op-tee_os" + +DEPENDS = "python3-pyelftools-native python3-cryptography-native" + +DEPENDS:append:toolchain-clang = " compiler-rt" + +FILESEXTRAPATHS:prepend := "${THISDIR}/optee-os:" + +SRC_URI = "git://github.com/OP-TEE/optee_os.git;branch=master;protocol=https" + +SRC_URI += "file://0001-remove-TA-access-permission-and-change-uuid.patch" + +S = "${WORKDIR}/git" +B = "${WORKDIR}/build" + +EXTRA_OEMAKE += " \ + PLATFORM=${OPTEEMACHINE} \ + CFG_${OPTEE_CORE}_core=y \ + CROSS_COMPILE_core=${HOST_PREFIX} \ + CROSS_COMPILE_ta_${OPTEE_ARCH}=${HOST_PREFIX} \ + NOWERROR=1 \ + ta-targets=ta_${OPTEE_ARCH} \ + O=${B} \ +" + +CFLAGS[unexport] = "1" +LDFLAGS[unexport] = "1" +CPPFLAGS[unexport] = "1" +AS[unexport] = "1" +LD[unexport] = "1" + +do_configure[noexec] = "1" + +do_compile() { + oe_runmake -C ${S} all +} +do_compile[cleandirs] = "${B}" + +do_install() { + #install core in firmware + install -d ${D}${nonarch_base_libdir}/firmware/ + install -m 644 ${B}/core/*.bin ${B}/core/tee.elf ${D}${nonarch_base_libdir}/firmware/ + + #install tas in optee_armtz + install -d ${D}${nonarch_base_libdir}/optee_armtz/ + install -m 444 ${B}/ta/*/*.ta ${D}${nonarch_base_libdir}/optee_armtz +} + +PACKAGE_ARCH = "${MACHINE_ARCH}" + +do_deploy() { + install -d ${DEPLOYDIR}/${MLPREFIX}optee + install -m 644 ${D}${nonarch_base_libdir}/firmware/* ${DEPLOYDIR}/${MLPREFIX}optee +} + +addtask deploy before do_build after do_install + +SYSROOT_DIRS += "${nonarch_base_libdir}/firmware" + +PACKAGES += "${PN}-ta" +# FILES:${PN} = "${nonarch_base_libdir}/firmware/" + +# note: "textrel" is not triggered on all archs +INSANE_SKIP:${PN} = "textrel" +INSANE_SKIP:${PN}-dev = "staticdev" + +INHIBIT_PACKAGE_STRIP = "1" diff --git a/recipes-bsp/optee/optee-os/0001-remove-TA-access-permission-and-change-uuid.patch b/recipes-bsp/optee/optee-os/0001-remove-TA-access-permission-and-change-uuid.patch new file mode 100644 index 000000000..c38c99172 --- /dev/null +++ b/recipes-bsp/optee/optee-os/0001-remove-TA-access-permission-and-change-uuid.patch @@ -0,0 +1,32 @@ +diff --git a/ta/trusted_keys/entry.c b/ta/trusted_keys/entry.c +index a806e7240..08be85723 100644 +--- a/ta/trusted_keys/entry.c ++++ b/ta/trusted_keys/entry.c +@@ -299,26 +299,7 @@ TEE_Result TA_OpenSessionEntryPoint(uint32_t pt __unused, + TEE_Param params[TEE_NUM_PARAMS] __unused, + void **session __unused) + { +- TEE_Result res = TEE_ERROR_GENERIC; +- TEE_PropSetHandle h = TEE_HANDLE_NULL; +- TEE_Identity id = { }; +- +- res = TEE_AllocatePropertyEnumerator(&h); +- if (res) +- goto out; +- +- TEE_StartPropertyEnumerator(h, TEE_PROPSET_CURRENT_CLIENT); +- +- res = TEE_GetPropertyAsIdentity(h, NULL, &id); +- if (res) +- goto out; +- +- if (id.login != TEE_LOGIN_REE_KERNEL) +- res = TEE_ERROR_ACCESS_DENIED; +- +-out: +- if (h) +- TEE_FreePropertyEnumerator(h); ++ TEE_Result res = TEE_SUCCESS; + return res; + } + diff --git a/recipes-bsp/optee/optee-os_4.4.0.bb b/recipes-bsp/optee/optee-os_4.4.0.bb new file mode 100644 index 000000000..d94165607 --- /dev/null +++ b/recipes-bsp/optee/optee-os_4.4.0.bb @@ -0,0 +1,20 @@ +require optee-os.inc + +DEPENDS += "dtc-native" + +SRCREV = "8f645256efc0dc66bd5c118778b0b50c44469ae1" + +COMPATIBLE_MACHINE = "^rpi$" + +EXTRA_OEMAKE += "\ + CFG_DEBUG_INFO=y \ + CFG_TEE_CORE_DEBUG=y \ + CFG_TEE_CORE_LOG_LEVEL=4 \ + CFG_TEE_TA_LOG_LEVEL=3 \ + CFG_DT=y \ + " + +FILES:${PN} = " \ + /lib/firmware/* \ + /lib/optee_armtz/* \ + " \ No newline at end of file diff --git a/recipes-bsp/optee/optee-test.inc b/recipes-bsp/optee/optee-test.inc new file mode 100644 index 000000000..09f04293d --- /dev/null +++ b/recipes-bsp/optee/optee-test.inc @@ -0,0 +1,64 @@ +SUMMARY = "OP-TEE sanity testsuite" +DESCRIPTION = "Open Portable Trusted Execution Environment - Test suite" +HOMEPAGE = "https://www.op-tee.org/" + +LICENSE = "BSD-2-Clause & GPL-2.0-only" +LIC_FILES_CHKSUM = "file://LICENSE.md;md5=a8fa504109e4cd7ea575bc49ea4be560" + +inherit python3native ptest +inherit deploy +require optee.inc + +DEPENDS = "optee-client optee-os-tadevkit python3-cryptography-native openssl" + +FILESEXTRAPATHS:prepend := "${THISDIR}/optee-test:" + +SRC_URI = "git://github.com/OP-TEE/optee_test.git;branch=master;protocol=https \ + file://run-ptest \ + " + +S = "${WORKDIR}/git" +B = "${WORKDIR}/build" + +EXTRA_OEMAKE += "TA_DEV_KIT_DIR=${TA_DEV_KIT_DIR} \ + OPTEE_OPENSSL_EXPORT=${STAGING_INCDIR} \ + CROSS_COMPILE_HOST=${HOST_PREFIX} \ + CROSS_COMPILE_TA=${HOST_PREFIX} \ + O=${B} \ + " + +CFLAGS += "-Wno-error=deprecated-declarations" + +do_compile() { + cd ${S} + # Top level makefile doesn't seem to handle parallel make gracefully + oe_runmake xtest + oe_runmake ta + oe_runmake test_plugin +} +do_compile[cleandirs] = "${B}" + +do_install () { + install -D -p -m0755 ${B}/xtest/xtest ${D}${bindir}/xtest + + # install path should match the value set in optee-client/tee-supplicant + # default TEEC_LOAD_PATH is /lib + mkdir -p ${D}${nonarch_base_libdir}/optee_armtz/ + install -D -p -m0444 ${B}/ta/*/*.ta ${D}${nonarch_base_libdir}/optee_armtz/ + mkdir -p ${D}${libdir}/tee-supplicant/plugins + install -D -p -m0444 ${B}/supp_plugin/*.plugin ${D}${libdir}/tee-supplicant/plugins/ +} + +do_deploy () { + install -d ${DEPLOYDIR}/${MLPREFIX}optee/ta + install -m 644 ${B}/ta/*/*.elf ${DEPLOYDIR}/${MLPREFIX}optee/ta +} + +addtask deploy before do_build after do_install + +FILES:${PN} += "${nonarch_base_libdir}/optee_armtz/ \ + ${libdir}/tee-supplicant/plugins/ \ + " + +# Imports machine specific configs from staging to build +PACKAGE_ARCH = "${MACHINE_ARCH}" diff --git a/recipes-bsp/optee/optee-test/run-ptest b/recipes-bsp/optee/optee-test/run-ptest new file mode 100644 index 000000000..ba88c14d3 --- /dev/null +++ b/recipes-bsp/optee/optee-test/run-ptest @@ -0,0 +1,52 @@ +#!/bin/sh +xtest | awk ' + + # Escapes the special characters in a string so that, when + # included in a regex, it represents a literal match + function regx_escape_literal(str, ret) { + ret = str + gsub(/[\[\]\^\$\.\*\?\+\{\}\\\(\)\|]/ , "\\\\&", str) + return str + } + + # Returns the simple test formatted name + function name(n, ret) { + ret = n + gsub(/\./, " ", ret) + return ret + } + + # Returns the simple test formatted result + function result(res) { + if(res ~ /OK/) { + return "PASS" + } else if(res ~ /FAILED/) { + return "FAIL" + } + } + + function parse(name, description, has_subtests, result_line) { + has_subtests = 0 + + # Consume every line up to the result line + result_line = " " regx_escape_literal(name) " (OK|FAILED)" + do { + getline + + # If this is a subtest (denoted by an "o" bullet) then subparse + if($0 ~ /^o /) { + parse($2, description " : " substr($0, index($0, $3))) + has_subtests = 1 + } + } while ($0 !~ result_line) + + # Only print the results for the deepest nested subtests + if(!has_subtests) { + print result($2) ": " name(name) " - " description + } + } + + # Start parsing at the beginning of every test (denoted by a "*" bullet) + /^\* / { parse($2, substr($0, index($0, $3))) } + +' diff --git a/recipes-bsp/optee/optee-test_4.4.0.bb b/recipes-bsp/optee/optee-test_4.4.0.bb new file mode 100644 index 000000000..f357808c7 --- /dev/null +++ b/recipes-bsp/optee/optee-test_4.4.0.bb @@ -0,0 +1,31 @@ +require optee-test.inc + +SRCREV = "695231ef8987866663a9ed5afd8f77d1bae3dc08" + +COMPATIBLE_MACHINE = "^rpi$" + +# Include ffa_spmc test group if the SPMC test is enabled. +# Supported after op-tee v3.20 +EXTRA_OEMAKE:append = "${@bb.utils.contains('MACHINE_FEATURES', 'optee-spmc-test', \ + ' CFG_SPMC_TESTS=y CFG_SECURE_PARTITION=y', '' , d)}" + +RDEPENDS:${PN} += "${@bb.utils.contains('MACHINE_FEATURES', 'optee-spmc-test', \ + ' arm-ffa-user', '' , d)}" + + +do_install:append(){ + install -d ${D}${bindir} + install -m 0755 ${B}/xtest/xtest ${D}${bindir}/xtest + + install -d ${D}${base_libdir}/optee_armtz + install -m 0444 ${B}/ta/*/*.ta ${D}${base_libdir}/optee_armtz + + install -d ${D}${libdir}/tee-supplicant/plugins + install -m 0444 ${B}/supp_plugin/*.plugin ${D}${libdir}/tee-supplicant/plugins/ +} + +FILES:${PN} += " \ + ${bindir}/xtest \ + ${base_libdir}/optee_armtz/* \ + ${libdir}/tee-supplicant/plugins/* \ + " \ No newline at end of file diff --git a/recipes-bsp/optee/optee.inc b/recipes-bsp/optee/optee.inc new file mode 100644 index 000000000..b096f218c --- /dev/null +++ b/recipes-bsp/optee/optee.inc @@ -0,0 +1,32 @@ +UPSTREAM_CHECK_GITTAGREGEX = "^(?P\d+(\.\d+)+)$" + +COMPATIBLE_MACHINE ?= "invalid" +COMPATIBLE_MACHINE:qemuarm64 ?= "qemuarm64" +COMPATIBLE_MACHINE:qemu-generic-arm64 ?= "qemu-generic-arm64" +# Please add supported machines below or set it in .bbappend or .conf + +OPTEEMACHINE ?= "rpi3" +OPTEEMACHINE:aarch64:qemuall ?= "vexpress-qemu_armv8a" + +OPTEE_ARCH = "null" +OPTEE_ARCH:arm = "arm32" +OPTEE_ARCH:aarch64 = "arm64" +OPTEE_CORE = "${@d.getVar('OPTEE_ARCH').upper()}" + +OPTEE_TOOLCHAIN = "${@d.getVar('TOOLCHAIN') or 'gcc'}" +OPTEE_COMPILER = "${@bb.utils.contains("BBFILE_COLLECTIONS", "clang-layer", "${OPTEE_TOOLCHAIN}", "gcc", d)}" + +# Set here but not passed to EXTRA_OEMAKE by default as that breaks +# the optee-os build +TA_DEV_KIT_DIR = "${STAGING_INCDIR}/optee/export-user_ta" + +EXTRA_OEMAKE += "V=1 \ + CFLAGS32=--sysroot=${STAGING_DIR_HOST} \ + CFLAGS64=--sysroot=${STAGING_DIR_HOST} \ + COMPILER=${OPTEE_COMPILER} \ + OPTEE_CLIENT_EXPORT=${STAGING_DIR_HOST}${prefix} \ + TEEC_EXPORT=${STAGING_DIR_HOST}${prefix} \ + " +# python3-cryptography needs the legacy provider, so set OPENSSL_MODULES to the +# right path until this is relocated automatically. +export OPENSSL_MODULES="${STAGING_LIBDIR_NATIVE}/ossl-modules" diff --git a/recipes-bsp/trusted-firmware-a/files/0001-rpi3-pass-DTB-address-to-BL32-OP-TEE.patch b/recipes-bsp/trusted-firmware-a/files/0001-rpi3-pass-DTB-address-to-BL32-OP-TEE.patch new file mode 100644 index 000000000..89a7b2b09 --- /dev/null +++ b/recipes-bsp/trusted-firmware-a/files/0001-rpi3-pass-DTB-address-to-BL32-OP-TEE.patch @@ -0,0 +1,42 @@ +From: Fix OP-TEE not receiving DTB on RPi3 +Subject: [PATCH] rpi3: pass preloaded DTB address to BL32 (OP-TEE) + +Uncomment the block that sets bl32_image_ep_info.args.arg2 to +RPI3_PRELOADED_DTB_BASE so OP-TEE receives the DTB address in +register x2 at startup. Without this, OP-TEE prints "No fdt" and +"No non-secure external DT", disabling ASLR seeding and console +auto-detection from the device tree. + +Signed-off-by: Fix +--- + plat/rpi/rpi3/rpi3_bl31_setup.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/plat/rpi/rpi3/rpi3_bl31_setup.c b/plat/rpi/rpi3/rpi3_bl31_setup.c +index xxxxxxx..yyyyyyy 100644 +--- a/plat/rpi/rpi3/rpi3_bl31_setup.c ++++ b/plat/rpi/rpi3/rpi3_bl31_setup.c +@@ -111,13 +111,11 @@ void bl31_early_platform_setup2(u_register_t arg0, u_register_t arg1, + panic(); + } + +-// #ifdef RPI3_PRELOADED_DTB_BASE +-// /* +-// * If we have a preloaded DTB, pass its physical address to BL32 +-// * through the BL32 entry args so that OP-TEE can pick it up as the +-// * external DT. BL32 (OP-TEE) expects the DT address in register a2. +-// */ +-// if (bl32_image_ep_info.pc) +-// bl32_image_ep_info.args.arg2 = (u_register_t)RPI3_PRELOADED_DTB_BASE; +-// #endif ++#ifdef RPI3_PRELOADED_DTB_BASE ++ /* ++ * If we have a preloaded DTB, pass its physical address to BL32 ++ * through the BL32 entry args so that OP-TEE can pick it up as the ++ * external DT. BL32 (OP-TEE) expects the DT address in register a2. ++ */ ++ if (bl32_image_ep_info.pc) ++ bl32_image_ep_info.args.arg2 = (u_register_t)RPI3_PRELOADED_DTB_BASE; ++#endif + + #if RPI3_DIRECT_LINUX_BOOT diff --git a/recipes-bsp/trusted-firmware-a/files/ssl.patch b/recipes-bsp/trusted-firmware-a/files/ssl.patch new file mode 100644 index 000000000..cdabd1b70 --- /dev/null +++ b/recipes-bsp/trusted-firmware-a/files/ssl.patch @@ -0,0 +1,52 @@ +fiptool: respect OPENSSL_DIR + +fiptool links to libcrypto, so as with the other tools it should respect +OPENSSL_DIR for include/library paths. + +Upstream-Status: Submitted +Signed-off-by: Ross Burton + +diff --git a/Makefile b/Makefile +index ec6f88585..2d3b9fc26 100644 +--- a/Makefile ++++ b/Makefile +@@ -1388,7 +1388,7 @@ fwu_fip: ${BUILD_PLAT}/${FWU_FIP_NAME} + + ${FIPTOOL}: FORCE + ifdef UNIX_MK +- ${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" FIPTOOL=${FIPTOOL} --no-print-directory -C ${FIPTOOLPATH} ++ ${Q}${MAKE} CPPFLAGS="-DVERSION='\"${VERSION_STRING}\"'" FIPTOOL=${FIPTOOL} OPENSSL_DIR=${OPENSSL_DIR} --no-print-directory -C ${FIPTOOLPATH} + else + # Clear the MAKEFLAGS as we do not want + # to pass the gnumake flags to nmake. +diff --git a/tools/fiptool/Makefile b/tools/fiptool/Makefile +index 11d2e7b0b..7c2a08379 100644 +--- a/tools/fiptool/Makefile ++++ b/tools/fiptool/Makefile +@@ -12,6 +12,8 @@ FIPTOOL ?= fiptool${BIN_EXT} + PROJECT := $(notdir ${FIPTOOL}) + OBJECTS := fiptool.o tbbr_config.o + V ?= 0 ++OPENSSL_DIR := /usr ++ + + override CPPFLAGS += -D_GNU_SOURCE -D_XOPEN_SOURCE=700 + HOSTCCFLAGS := -Wall -Werror -pedantic -std=c99 +@@ -20,7 +22,7 @@ ifeq (${DEBUG},1) + else + HOSTCCFLAGS += -O2 + endif +-LDLIBS := -lcrypto ++LDLIBS := -L${OPENSSL_DIR}/lib -lcrypto + + ifeq (${V},0) + Q := @ +@@ -28,7 +30,7 @@ else + Q := + endif + +-INCLUDE_PATHS := -I../../include/tools_share ++INCLUDE_PATHS := -I../../include/tools_share -I${OPENSSL_DIR}/include + + HOSTCC ?= gcc + diff --git a/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc b/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc new file mode 100644 index 000000000..00950bd4a --- /dev/null +++ b/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc @@ -0,0 +1,246 @@ +DESCRIPTION = "Trusted Firmware-A" +LICENSE = "BSD-3-Clause & MIT" + +PACKAGE_ARCH = "${MACHINE_ARCH}" + +inherit deploy + +SRC_URI = "git://git.trustedfirmware.org/TF-A/trusted-firmware-a.git;protocol=https;name=tfa;branch=master \ + " +UPSTREAM_CHECK_GITTAGREGEX = "^v(?P\d+(\.\d+)+)$" + +SRCREV_FORMAT = "tfa" + +COMPATIBLE_MACHINE ?= "invalid" + +# Platform must be set for each machine +TFA_PLATFORM ?= "invalid" + +# Some platforms can have multiple board configurations +# Leave empty for default behavior +TFA_BOARD ?= "" + +# Some platforms use SPD (Secure Payload Dispatcher) services +# Few options are "opteed", "tlkd", "trusty", "tspd", "spmd"... +# Leave empty to not use SPD +TFA_SPD ?= "" + +# Variable used when TFA_SPD=spmd +TFA_SPMD_SPM_AT_SEL2 ?= "1" + +# SP layout file location. Used when TFA_SPD=spmd and TFA_SPMD_SPM_AT_SEL2=1 +TFA_SP_LAYOUT_FILE ?= "" + +# SPMC manifest file location. Used when TFA_SPD=spmd and TFA_SPMD_SPM_AT_SEL2=1 +TFA_ARM_SPMC_MANIFEST_DTS ?= "" + +# Build for debug (set TFA_DEBUG to 1 to activate) +TFA_DEBUG ?= "0" + +S = "${WORKDIR}/git" +B = "${WORKDIR}/build" + +# mbed TLS support (set TFA_MBEDTLS to 1 to activate) +TFA_MBEDTLS ?= "0" +# sub-directory in which mbedtls will be downloaded +TFA_MBEDTLS_DIR ?= "mbedtls" +# This should be set to MBEDTLS download URL if MBEDTLS is needed +SRC_URI_MBEDTLS ??= "" +# This should be set to MBEDTLS LIC FILES checksum +LIC_FILES_CHKSUM_MBEDTLS ??= "" +# add MBEDTLS to our sources if activated +SRC_URI:append = " ${@bb.utils.contains('TFA_MBEDTLS', '1', '${SRC_URI_MBEDTLS}', '', d)}" +# Update license variables +LICENSE:append = "${@bb.utils.contains('TFA_MBEDTLS', '1', ' & Apache-2.0', '', d)}" +LIC_FILES_CHKSUM:append = "${@bb.utils.contains('TFA_MBEDTLS', '1', ' ${LIC_FILES_CHKSUM_MBEDTLS}', '', d)}" +# add mbed TLS to version +SRCREV_FORMAT:append = "${@bb.utils.contains('TFA_MBEDTLS', '1', '_mbedtls', '', d)}" + +# U-boot support (set TFA_UBOOT to 1 to activate) +# When U-Boot support is activated BL33 is activated with u-boot.bin file +TFA_UBOOT ??= "0" + +# UEFI support (set TFA_UEFI to 1 to activate) +# When UEFI support is activated BL33 is activated with uefi.bin file +TFA_UEFI ??= "0" + +# What to build +# By default we only build bl1, do_deploy will copy +# everything listed in this variable (by default bl1.bin) +TFA_BUILD_TARGET ?= "bl1" + +# What to install +# do_install and do_deploy will install everything listed in this +# variable. It is set by default to TFA_BUILD_TARGET +TFA_INSTALL_TARGET ?= "${TFA_BUILD_TARGET}" + +# Requires CROSS_COMPILE set by hand as there is no configure script +export CROSS_COMPILE="${TARGET_PREFIX}" + +# Let the Makefile handle setting up the CFLAGS and LDFLAGS as it is a standalone application +CFLAGS[unexport] = "1" +LDFLAGS[unexport] = "1" +AS[unexport] = "1" +LD[unexport] = "1" + +# No configure +do_configure[noexec] = "1" + +# Baremetal, just need a compiler +DEPENDS:remove = "virtual/${TARGET_PREFIX}compilerlibs virtual/libc" + +# We need dtc for dtbs compilation +# We need openssl for fiptool +DEPENDS += "dtc-native openssl-native" +DEPENDS:append:toolchain-clang = " compiler-rt" + +# CC and LD introduce arguments which conflict with those otherwise provided by +# this recipe. The heads of these variables excluding those arguments +# are therefore used instead. +def remove_options_tail (in_string): + from itertools import takewhile + return ' '.join(takewhile(lambda x: not x.startswith('-'), in_string.split(' '))) + +EXTRA_OEMAKE += "LD=${@remove_options_tail(d.getVar('LD'))}" + +EXTRA_OEMAKE += "CC=${@remove_options_tail(d.getVar('CC'))}" + +# Verbose builds, no -Werror +EXTRA_OEMAKE += "V=1 E=0" + +# Add platform parameter +EXTRA_OEMAKE += "BUILD_BASE=${B} PLAT=${TFA_PLATFORM}" + +# Handle TFA_BOARD parameter +EXTRA_OEMAKE += "${@'TARGET_BOARD=${TFA_BOARD}' if d.getVar('TFA_BOARD') else ''}" + +# Handle TFA_SPD parameter +EXTRA_OEMAKE += "${@'SPD=${TFA_SPD}' if d.getVar('TFA_SPD') else ''}" + +# If TFA_SPD is spmd, set SPMD_SPM_AT_SEL2 +EXTRA_OEMAKE += "${@'SPMD_SPM_AT_SEL2=${TFA_SPMD_SPM_AT_SEL2}' if d.getVar('TFA_SPD', True) == 'spmd' else ''}" + +# Handle TFA_DEBUG parameter +EXTRA_OEMAKE += "${@bb.utils.contains('TFA_DEBUG', '1', 'DEBUG=${TFA_DEBUG}', '', d)}" + +# Handle MBEDTLS +EXTRA_OEMAKE += "${@bb.utils.contains('TFA_MBEDTLS', '1', 'MBEDTLS_DIR=${TFA_MBEDTLS_DIR}', '', d)}" + +# Uboot support +DEPENDS += " ${@bb.utils.contains('TFA_UBOOT', '1', 'u-boot', '', d)}" +do_compile[depends] += " ${@bb.utils.contains('TFA_UBOOT', '1', 'u-boot:do_deploy', '', d)}" +EXTRA_OEMAKE += "${@bb.utils.contains('TFA_UBOOT', '1', 'BL33=${DEPLOY_DIR_IMAGE}/u-boot.bin', '', d)}" + +# UEFI support +DEPENDS += " ${@bb.utils.contains('TFA_UEFI', '1', 'edk2-firmware', '', d)}" +EXTRA_OEMAKE += "${@bb.utils.contains('TFA_UEFI', '1', 'BL33=${RECIPE_SYSROOT}/firmware/uefi.bin', '', d)}" + +# TFTF test support +DEPENDS += " ${@bb.utils.contains('TFTF_TESTS', '1', 'tf-a-tests', '', d)}" +EXTRA_OEMAKE += "${@bb.utils.contains('TFTF_TESTS', '1', 'BL33=${RECIPE_SYSROOT}/firmware/tftf.bin', '',d)}" + +# Hafnium support +SEL2_SPMC = "${@'${TFA_SPMD_SPM_AT_SEL2}' if d.getVar('TFA_SPD', True) == 'spmd' else ''}" + +DEPENDS += " ${@bb.utils.contains('SEL2_SPMC', '1', 'hafnium', '', d)}" + +EXTRA_OEMAKE += "${@bb.utils.contains('SEL2_SPMC', '1', 'CTX_INCLUDE_EL2_REGS=1 ARM_ARCH_MINOR=4 BL32=${RECIPE_SYSROOT}/firmware/hafnium.bin', '', d)}" + +# Add SP layout file and spmc manifest for hafnium +EXTRA_OEMAKE += "${@bb.utils.contains('SEL2_SPMC', '1', 'SP_LAYOUT_FILE=${TFA_SP_LAYOUT_FILE}' if d.getVar('TFA_SP_LAYOUT_FILE') else '', '', d)}" + +EXTRA_OEMAKE += "${@bb.utils.contains('SEL2_SPMC', '1', 'ARM_SPMC_MANIFEST_DTS=${TFA_ARM_SPMC_MANIFEST_DTS}' if d.getVar('TFA_ARM_SPMC_MANIFEST_DTS') else '', '', d)}" + +# Tell the tools where the native OpenSSL is located +EXTRA_OEMAKE += "OPENSSL_DIR=${STAGING_DIR_NATIVE}/${prefix_native}" +# Use the correct native compiler +EXTRA_OEMAKE += "HOSTCC='${BUILD_CC}'" + +# Runtime variables +EXTRA_OEMAKE += "RUNTIME_SYSROOT=${STAGING_DIR_HOST}" + +BUILD_DIR = "${B}/${TFA_PLATFORM}" +BUILD_DIR .= "${@'/${TFA_BOARD}' if d.getVar('TFA_BOARD') else ''}" +BUILD_DIR .= "/${@'debug' if d.getVar("TFA_DEBUG") == '1' else 'release'}" + +do_compile() { + # This is still needed to have the native tools executing properly by + # setting the RPATH + sed -i '/^LDLIBS/ s,$, \$\{BUILD_LDFLAGS},' ${S}/tools/fiptool/Makefile + sed -i '/^INCLUDE_PATHS/ s,$, \$\{BUILD_CFLAGS},' ${S}/tools/fiptool/Makefile + sed -i '/^LIB/ s,$, \$\{BUILD_LDFLAGS},' ${S}/tools/cert_create/Makefile + + # Currently there are races if you build all the targets at once in parallel + for T in ${TFA_BUILD_TARGET}; do + oe_runmake -C ${S} $T + done +} +do_compile[cleandirs] = "${B}" + +do_install() { + install -d -m 755 ${D}/firmware + for atfbin in ${TFA_INSTALL_TARGET}; do + processed="0" + if [ "$atfbin" = "all" ]; then + # Target all is not handled by default + bberror "all as TFA_INSTALL_TARGET is not handled by do_install" + bberror "Please specify valid targets in TFA_INSTALL_TARGET or" + bberror "rewrite or turn off do_install" + exit 1 + fi + + if [ -f ${BUILD_DIR}/$atfbin.bin ]; then + echo "Install $atfbin.bin" + install -m 0644 ${BUILD_DIR}/$atfbin.bin \ + ${D}/firmware/$atfbin-${TFA_PLATFORM}.bin + ln -sf $atfbin-${TFA_PLATFORM}.bin ${D}/firmware/$atfbin.bin + processed="1" + fi + if [ -f ${BUILD_DIR}/$atfbin/$atfbin.elf ]; then + echo "Install $atfbin.elf" + install -m 0644 ${BUILD_DIR}/$atfbin/$atfbin.elf \ + ${D}/firmware/$atfbin-${TFA_PLATFORM}.elf + ln -sf $atfbin-${TFA_PLATFORM}.elf ${D}/firmware/$atfbin.elf + processed="1" + fi + if [ -f ${BUILD_DIR}/$atfbin ]; then + echo "Install $atfbin" + install -m 0644 ${BUILD_DIR}/$atfbin \ + ${D}/firmware/$atfbin-${TFA_PLATFORM} + ln -sf $atfbin-${TFA_PLATFORM} ${D}/firmware/$atfbin + processed="1" + fi + if [ -f ${BUILD_DIR}/fdts/$atfbin.dtb ]; then + echo "Install $atfbin.dtb" + install -m 0644 "${BUILD_DIR}/fdts/$atfbin.dtb" \ + "${D}/firmware/$atfbin.dtb" + processed="1" + elif [ "$atfbin" = "dtbs" ]; then + echo "dtbs install, skipped: set dtbs in TFA_INSTALL_TARGET" + elif [ -f ${B}/tools/$atfbin/$atfbin ]; then + echo "Tools $atfbin install, skipped" + elif [ "$processed" = "0" ]; then + bberror "Unsupported TFA_INSTALL_TARGET target $atfbin" + exit 1 + fi + done +} + +FILES:${PN} = "/firmware" +SYSROOT_DIRS += "/firmware" + +FILES:${PN}-dbg = "/firmware/*.elf" +# Skip QA check for relocations in .text of elf binaries +INSANE_SKIP:${PN}-dbg = "textrel" + +do_deploy() { + cp -rf ${D}/firmware/* ${DEPLOYDIR}/ + cp ${B}/rpi3/debug/armstub8.bin ${DEPLOYDIR}/${BOOTFILES_DIR_NAME} +} +addtask deploy after do_install +do_deploy[dirs] += "${DEPLOYDIR}/${BOOTFILES_DIR_NAME}" + +CVE_PRODUCT = "arm:arm-trusted-firmware \ + arm:trusted_firmware-a \ + arm:arm_trusted_firmware \ + arm_trusted_firmware_project:arm_trusted_firmware" diff --git a/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend b/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend new file mode 100644 index 000000000..320807116 --- /dev/null +++ b/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend @@ -0,0 +1,29 @@ +COMPATIBLE_MACHINE:qemuarm64-secureboot = "qemuarm64-secureboot" +COMPATIBLE_MACHINE:qemu-generic-arm64 = "qemu-generic-arm64" + +TFA_PLATFORM:qemuarm64-secureboot = "qemu" +TFA_PLATFORM:qemu-generic-arm64 = "qemu_sbsa" + +TFA_SPD:qemuarm64-secureboot = "opteed" + +TFA_UBOOT:qemuarm64-secureboot = "1" +TFA_BUILD_TARGET:aarch64:qemuall = "all fip" + +TFA_INSTALL_TARGET:qemuarm64-secureboot = "flash.bin" +TFA_INSTALL_TARGET:qemu-generic-arm64 = "bl1 fip" + +DEPENDS:append:aarch64:qemuall = " optee-os" + +EXTRA_OEMAKE:append:aarch64:qemuall = " \ + BL32=${STAGING_DIR_TARGET}${nonarch_base_libdir}/firmware/tee-header_v2.bin \ + BL32_EXTRA1=${STAGING_DIR_TARGET}${nonarch_base_libdir}/firmware/tee-pager_v2.bin \ + BL32_EXTRA2=${STAGING_DIR_TARGET}${nonarch_base_libdir}/firmware/tee-pageable_v2.bin \ + BL32_RAM_LOCATION=tdram \ + " + +do_compile:append:qemuarm64-secureboot() { + # Create a secure flash image for booting AArch64 Qemu. See: + # https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/tree/docs/plat/qemu.rst + dd if=${BUILD_DIR}/bl1.bin of=${BUILD_DIR}/flash.bin bs=4096 conv=notrunc + dd if=${BUILD_DIR}/fip.bin of=${BUILD_DIR}/flash.bin seek=64 bs=4096 conv=notrunc +} \ No newline at end of file diff --git a/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.7.bb b/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.7.bb new file mode 100644 index 000000000..be78017e6 --- /dev/null +++ b/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.7.bb @@ -0,0 +1,58 @@ +require trusted-firmware-a.inc +DEPENDS += " coreutils-native" + +# FILESEXTRAPATHS:prepend := "${THISDIR}/files:" +# SRC_URI:append = " file://0001-rpi3-pass-DTB-address-to-BL32-OP-TEE.patch" +# TF-A v2.7 +SRCREV_tfa = "35f4c7295bafeb32c8bcbdfb6a3f2e74a57e732b" + +LIC_FILES_CHKSUM += "file://docs/license.rst;md5=b2c740efedc159745b9b31f88ff03dde" + +# mbed TLS v2.28.0 +SRC_URI_MBEDTLS = "git://github.com/ARMmbed/mbedtls.git;name=mbedtls;protocol=https;destsuffix=git/mbedtls;branch=mbedtls-2.28" +SRCREV_mbedtls = "8b3f26a5ac38d4fdccbc5c5366229f3e01dafcc0" + +LIC_FILES_CHKSUM_MBEDTLS = "file://mbedtls/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57" + + +COMPATIBLE_MACHINE = "^rpi$" +TFA_PLATFORM = "rpi3" +TFA_DEBUG = "1" +TFA_UBOOT = "1" +TFA_BUILD_TARGET = "all fip" +TFA_INSTALL_TARGET = "bl1 bl2 bl31 dtbs fip" +TFA_SPD = "opteed" + +# BL1 loads BL32 (optee). So, optee needs to be built first: +DEPENDS += "optee-os u-boot" + + +EXTRA_OEMAKE += " \ + PLAT=rpi3 \ + NEED_BL32=yes \ + BL32=${RECIPE_SYSROOT}/lib/firmware/tee-header_v2.bin \ + BL32_EXTRA1=${RECIPE_SYSROOT}/lib/firmware/tee-pager_v2.bin \ + BL32_EXTRA2=${RECIPE_SYSROOT}/lib/firmware/tee-pageable_v2.bin \ + BL33=${RECIPE_SYSROOT}/lib/firmware/u-boot.bin \ + LOG_LEVEL=40 \ + CRASH_REPORTING=1 \ + RPI3_PRELOADED_DTB_BASE=0x01000000 \ + " + +do_compile:prepend() { + sed -i '/^LDLIBS/ s@$@ ${BUILD_LDFLAGS}@' ${S}/tools/fiptool/Makefile +} + +do_compile(){ + oe_runmake -C ${S} +} + +do_deploy[depends] += "optee-os:do_deploy" + +do_deploy(){ + install -d ${DEPLOYDIR}/${BOOTFILES_DIR_NAME} + cp ${B}/rpi3/debug/armstub8.bin ${DEPLOYDIR}/${BOOTFILES_DIR_NAME} +} + +addtask deploy before do_build after do_install +do_deploy[dirs] += "${DEPLOYDIR}/${BOOTFILES_DIR_NAME}" diff --git a/recipes-bsp/u-boot/files/myconfig.cfg b/recipes-bsp/u-boot/files/myconfig.cfg new file mode 100644 index 000000000..4497ca5b5 --- /dev/null +++ b/recipes-bsp/u-boot/files/myconfig.cfg @@ -0,0 +1,287 @@ +CONFIG_CREATE_ARCH_SYMLINK=y +CONFIG_LINKER_LIST_ALIGN=8 +CONFIG_ARM=y +CONFIG_SYS_ARCH="arm" +CONFIG_SYS_CPU="armv8" +CONFIG_SYS_SOC="bcm283x" +CONFIG_SYS_VENDOR="raspberrypi" +CONFIG_SYS_BOARD="rpi" +CONFIG_SYS_CONFIG_NAME="rpi" +CONFIG_ARM64=y +CONFIG_STATIC_RELA=y +CONFIG_DMA_ADDR_T_64BIT=y +CONFIG_GPIO_EXTRA_HEADER=y +CONFIG_ARM_ASM_UNIFIED=y +CONFIG_SYS_ARM_ARCH=8 +CONFIG_SYS_CACHE_SHIFT_6=y +CONFIG_SYS_CACHELINE_SIZE=64 +CONFIG_SYS_ARM_CACHE_WRITEBACK=y +CONFIG_ARCH_CPU_INIT=y +CONFIG_SYS_ARCH_TIMER=y +CONFIG_ARM64_SUPPORT_AARCH32=y +CONFIG_ARCH_BCM283X=y +CONFIG_SPL_LDSCRIPT="arch/arm/cpu/armv8/u-boot-spl.lds" +CONFIG_SYS_TEXT_BASE=0x11000000 +CONFIG_BCM2837=y +CONFIG_BCM2837_64B=y +CONFIG_TARGET_RPI_3=y +CONFIG_RPI_EFI_NR_SPIN_PAGES=1 +CONFIG_SYS_MALLOC_F_LEN=0x2000 +CONFIG_NR_DRAM_BANKS=1 +CONFIG_ENV_SIZE=0x4000 +CONFIG_DM_GPIO=y +CONFIG_DEFAULT_DEVICE_TREE="bcm2837-rpi-3-b" +CONFIG_ERR_PTR_OFFSET=0x0 +CONFIG_BOOTSTAGE_STASH_ADDR=0 +CONFIG_IDENT_STRING="" +CONFIG_IMX_DCD_ADDR=0x00910000 +CONFIG_BUILD_TARGET="" +CONFIG_LOCALVERSION="" +CONFIG_LOCALVERSION_AUTO=y +CONFIG_CC_IS_GCC=y +CONFIG_GCC_VERSION=110301 +CONFIG_CLANG_VERSION=0 +CONFIG_CC_OPTIMIZE_FOR_SIZE=y +CONFIG_ARCH_SUPPORTS_LTO=y +CONFIG_CC_HAS_ASM_INLINE=y +CONFIG_DISTRO_DEFAULTS=y +CONFIG_ENV_VARS_UBOOT_CONFIG=y +CONFIG_SYS_MALLOC_F=y +CONFIG_EXPERT=y +CONFIG_SYS_MALLOC_CLEAR_ON_INIT=y +CONFIG_PHYS_64BIT=y +CONFIG_PLATFORM_ELFENTRY="_start" +CONFIG_STACK_SIZE=0x1000000 +CONFIG_SYS_SRAM_BASE=0x0 +CONFIG_SYS_SRAM_SIZE=0x0 +CONFIG_LEGACY_IMAGE_FORMAT=y +CONFIG_SUPPORT_RAW_INITRD=y +CONFIG_OF_BOARD_SETUP=y +CONFIG_SYS_EXTRA_OPTIONS="" +CONFIG_HAVE_SYS_TEXT_BASE=y +CONFIG_ARCH_FIXUP_FDT_MEMORY=y +CONFIG_BOOTSTAGE_STASH_SIZE=0x1000 +CONFIG_AUTOBOOT=y +CONFIG_BOOTDELAY=2 +CONFIG_USE_BOOTCOMMAND=y +CONFIG_BOOTCOMMAND="run distro_bootcmd" +CONFIG_USE_PREBOOT=y +CONFIG_PREBOOT="usb start" +CONFIG_DEFAULT_FDT_FILE="" +CONFIG_MENU=y +CONFIG_LOGLEVEL=4 +CONFIG_SPL_LOGLEVEL=4 +CONFIG_TPL_LOGLEVEL=4 +CONFIG_CONSOLE_MUX=y +CONFIG_SYS_CONSOLE_IS_IN_ENV=y +CONFIG_SYS_STDIO_DEREGISTER=y +CONFIG_SYS_DEVICE_NULLDEV=y +CONFIG_MISC_INIT_R=y +CONFIG_HASH=y +CONFIG_SPL_SYS_STACK_F_CHECK_BYTE=0xaa +CONFIG_CMDLINE=y +CONFIG_HUSH_PARSER=y +CONFIG_CMDLINE_EDITING=y +CONFIG_AUTO_COMPLETE=y +CONFIG_SYS_LONGHELP=y +CONFIG_SYS_PROMPT="U-Boot> " +CONFIG_SYS_PROMPT_HUSH_PS2="> " +CONFIG_SYS_XTRACE=y +CONFIG_CMD_BDI=y +CONFIG_CMD_CONSOLE=y +CONFIG_CMD_BOOTD=y +CONFIG_CMD_BOOTM=y +CONFIG_CMD_BOOTI=y +CONFIG_BOOTM_LINUX=y +CONFIG_BOOTM_NETBSD=y +CONFIG_BOOTM_PLAN9=y +CONFIG_BOOTM_RTEMS=y +CONFIG_BOOTM_VXWORKS=y +CONFIG_CMD_BOOTEFI=y +CONFIG_CMD_BOOTEFI_HELLO_COMPILE=y +CONFIG_CMD_ELF=y +CONFIG_CMD_FDT=y +CONFIG_CMD_GO=y +CONFIG_CMD_RUN=y +CONFIG_CMD_IMI=y +CONFIG_CMD_XIMG=y +CONFIG_CMD_EXPORTENV=y +CONFIG_CMD_IMPORTENV=y +CONFIG_CMD_EDITENV=y +CONFIG_CMD_SAVEENV=y +CONFIG_CMD_ENV_EXISTS=y +CONFIG_CMD_CRC32=y +CONFIG_CMD_MEMORY=y +CONFIG_CMD_RANDOM=y +CONFIG_CMD_LZMADEC=y +CONFIG_CMD_UNLZ4=y +CONFIG_CMD_UNZIP=y +CONFIG_CMD_DM=y +CONFIG_CMD_GPIO=y +CONFIG_CMD_LOADB=y +CONFIG_CMD_LOADS=y +CONFIG_CMD_MMC=y +CONFIG_CMD_PART=y +CONFIG_CMD_PINMUX=y +CONFIG_CMD_USB=y +CONFIG_CMD_ECHO=y +CONFIG_CMD_ITEST=y +CONFIG_CMD_SOURCE=y +CONFIG_CMD_SETEXPR=y +CONFIG_CMD_NET=y +CONFIG_CMD_BOOTP=y +CONFIG_CMD_DHCP=y +CONFIG_BOOTP_BOOTPATH=y +CONFIG_BOOTP_DNS=y +CONFIG_BOOTP_GATEWAY=y +CONFIG_BOOTP_HOSTNAME=y +CONFIG_BOOTP_SUBNETMASK=y +CONFIG_BOOTP_PXE=y +CONFIG_BOOTP_PXE_CLIENTARCH=0x16 +CONFIG_BOOTP_VCI_STRING="U-Boot.armv8" +CONFIG_CMD_TFTPBOOT=y +CONFIG_NET_TFTP_VARS=y +CONFIG_CMD_NFS=y +CONFIG_CMD_MII=y +CONFIG_CMD_MDIO=y +CONFIG_CMD_PING=y +CONFIG_CMD_PXE=y +CONFIG_CMD_BLOCK_CACHE=y +CONFIG_CMD_SLEEP=y +CONFIG_CMD_SYSBOOT=y +CONFIG_CMD_EXT2=y +CONFIG_CMD_EXT4=y +CONFIG_CMD_FAT=y +CONFIG_CMD_FS_GENERIC=y +CONFIG_CMD_FS_UUID=y +CONFIG_PARTITIONS=y +CONFIG_DOS_PARTITION=y +CONFIG_ISO_PARTITION=y +CONFIG_EFI_PARTITION=y +CONFIG_EFI_PARTITION_ENTRIES_NUMBERS=128 +CONFIG_EFI_PARTITION_ENTRIES_OFF=0 +CONFIG_PARTITION_UUIDS=y +CONFIG_SUPPORT_OF_CONTROL=y +CONFIG_DTC=y +CONFIG_OF_CONTROL=y +CONFIG_OF_EMBED=y +CONFIG_ENV_SUPPORT=y +CONFIG_SAVEENV=y +CONFIG_ENV_IS_IN_FAT=y +CONFIG_ENV_FAT_INTERFACE="mmc" +CONFIG_ENV_FAT_DEVICE_AND_PART="0:1" +CONFIG_ENV_FAT_FILE="uboot.env" +CONFIG_SYS_RELOC_GD_ENV_ADDR=y +CONFIG_SYS_MMC_ENV_DEV=0 +CONFIG_SYS_MMC_ENV_PART=0 +CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y +CONFIG_NET=y +CONFIG_TFTP_BLOCKSIZE=1468 +CONFIG_TFTP_WINDOWSIZE=1 +CONFIG_TFTP_TSIZE=y +CONFIG_SERVERIP_FROM_PROXYDHCP_DELAY_MS=100 +CONFIG_DM=y +CONFIG_DM_WARN=y +CONFIG_DM_DEVICE_REMOVE=y +CONFIG_DM_STDIO=y +CONFIG_DM_SEQ_ALIAS=y +CONFIG_SIMPLE_BUS=y +CONFIG_OF_TRANSLATE=y +CONFIG_DM_DEV_READ_INLINE=y +CONFIG_BLK=y +CONFIG_HAVE_BLOCK_DEVICE=y +CONFIG_BLOCK_CACHE=y +CONFIG_CAAM_64BIT=y +CONFIG_I2C=y +CONFIG_INPUT=y +CONFIG_DM_KEYBOARD=y +CONFIG_MMC=y +CONFIG_MMC_WRITE=y +CONFIG_DM_MMC=y +CONFIG_MMC_QUIRKS=y +CONFIG_MMC_HW_PARTITIONING=y +CONFIG_MMC_VERBOSE=y +CONFIG_MMC_BCM2835=y +CONFIG_MMC_SDHCI=y +CONFIG_MMC_SDHCI_IO_ACCESSORS=y +CONFIG_MMC_SDHCI_BCM2835=y +CONFIG_PHYLIB=y +CONFIG_DM_ETH=y +CONFIG_NETDEVICES=y +CONFIG_PINCTRL=y +CONFIG_PINCTRL_FULL=y +CONFIG_PINCONF_RECURSIVE=y +CONFIG_PINCTRL_BCM283X=y +CONFIG_BAUDRATE=115200 +CONFIG_SERIAL_PRESENT=y +CONFIG_DM_SERIAL=y +CONFIG_SERIAL_SEARCH_ALL=y +CONFIG_BCM283X_MU_SERIAL=y +CONFIG_BCM283X_PL011_SERIAL=y +CONFIG_PL01X_SERIAL=y +CONFIG_SYSINFO=y +CONFIG_SYSINFO_SMBIOS=y +CONFIG_USB=y +CONFIG_DM_USB=y +CONFIG_USB_HOST=y +CONFIG_USB_DWC2=y +CONFIG_USB_DWC2_BUFFER_SIZE=64 +CONFIG_USB_STORAGE=y +CONFIG_USB_KEYBOARD=y +CONFIG_USB_KEYBOARD_FN_KEYS=y +CONFIG_SYS_USB_EVENT_POLL=y +CONFIG_USB_HOST_ETHER=y +CONFIG_USB_ETHER_LAN78XX=y +CONFIG_USB_ETHER_SMSC95XX=y +CONFIG_DM_VIDEO=y +CONFIG_BACKLIGHT=y +CONFIG_VIDEO_PCI_DEFAULT_FB_SIZE=0 +CONFIG_CMD_VIDCONSOLE=y +CONFIG_VIDEO_BPP32=y +CONFIG_VIDEO_ANSI=y +CONFIG_CONSOLE_NORMAL=y +CONFIG_SYS_WHITE_ON_BLACK=y +CONFIG_PANEL=y +CONFIG_SIMPLE_PANEL=y +CONFIG_CONSOLE_SCROLL_LINES=10 +CONFIG_WATCHDOG_TIMEOUT_MSECS=60000 +CONFIG_PHYS_TO_BUS=y +CONFIG_FS_EXT4=y +CONFIG_FS_FAT=y +CONFIG_FAT_WRITE=y +CONFIG_FS_FAT_MAX_CLUSTSIZE=65536 +CONFIG_CHARSET=y +CONFIG_LIB_UUID=y +CONFIG_PRINTF=y +CONFIG_SPRINTF=y +CONFIG_STRTO=y +CONFIG_SYS_HZ=1000 +CONFIG_REGEX=y +CONFIG_LIB_RAND=y +CONFIG_LZ4=y +CONFIG_LZMA=y +CONFIG_GZIP=y +CONFIG_ZLIB=y +CONFIG_OF_LIBFDT=y +CONFIG_OF_LIBFDT_ASSUME_MASK=0 +CONFIG_OF_LIBFDT_OVERLAY=y +CONFIG_GENERATE_SMBIOS_TABLE=y +CONFIG_EFI_LOADER=y +CONFIG_CMD_BOOTEFI_BOOTMGR=y +CONFIG_EFI_VARIABLE_FILE_STORE=y +CONFIG_EFI_VAR_BUF_SIZE=16384 +CONFIG_EFI_DEVICE_PATH_TO_TEXT=y +CONFIG_EFI_DEVICE_PATH_UTIL=y +CONFIG_EFI_DT_FIXUP=y +CONFIG_EFI_LOADER_HII=y +CONFIG_EFI_UNICODE_COLLATION_PROTOCOL2=y +CONFIG_EFI_UNICODE_CAPITALIZATION=y +CONFIG_EFI_PLATFORM_LANG_CODES="en-US" +CONFIG_EFI_HAVE_RUNTIME_RESET=y +CONFIG_EFI_LOAD_FILE2_INITRD=y +CONFIG_LIB_ELF=y +CONFIG_LMB=y +CONFIG_LMB_USE_MAX_REGIONS=y +CONFIG_LMB_MAX_REGIONS=8 +CONFIG_MKIMAGE_DTC_PATH="dtc" +CONFIG_TOOLS_LIBCRYPTO=y \ No newline at end of file diff --git a/recipes-bsp/u-boot/files/u-boot_rpi3_env b/recipes-bsp/u-boot/files/u-boot_rpi3_env new file mode 100644 index 000000000..318ef83c3 --- /dev/null +++ b/recipes-bsp/u-boot/files/u-boot_rpi3_env @@ -0,0 +1,37 @@ +# generic params +bootdelay=0 +stderr=serial,lcd +stdin=serial,usbkbd +stdout=serial,lcd + +# CPU config +cpu=armv8 +smp=on + +# Console config +baudrate=115200 +sttyconsole=ttyS0 +ttyconsole=tty0 + +# Kernel/dtb filenames & load addresses +boot_it=booti ${kernel_addr_r} - ${fdt_addr_r} +fdt_addr_r=0x01000000 +kernel_addr_r=0x02000000 + +# NFS/TFTP boot configuraton +gatewayip=192.168.1.1 +netmask=255.255.255.0 +nfsserverip=192.168.1.100 +nfspath=/srv/nfs/rpi + +# bootcmd & bootargs configuration +preboot=usb start +bootcmd=run mmcboot +load_kernel=fatload mmc 0:1 ${kernel_addr_r} kernel8.img +load_fdt=fatload mmc 0:1 ${fdt_addr_r} bcm2710-rpi-3-b-plus.dtb +mmcboot=run load_fdt; run load_kernel; run set_bootargs_tty set_bootargs_mmc set_common_args; run boot_it +nfsboot=run load_fdt; run load_kernel; run set_bootargs_tty set_bootargs_nfs set_common_args; run boot_it +set_bootargs_tty=setenv bootargs console=${ttyconsole} console=${sttyconsole},${baudrate} +set_bootargs_nfs=setenv bootargs ${bootargs} root=/dev/nfs rw rootfstype=nfs nfsroot=${nfsserverip}:${nfspath},udp,vers=3 ip=dhcp +set_bootargs_mmc=setenv bootargs ${bootargs} root=/dev/mmcblk0p2 rw rootfs=ext4 +set_common_args=setenv bootargs ${bootargs} smsc95xx.macaddr=${ethaddr} 'ignore_loglevel dma.dmachans=0x7f35 rootwait 8250.nr_uarts=1 elevator=deadline fsck.repair=yes bcm2708_fb.fbwidth=1920 bcm2708_fb.fbheight=1080 vc_mem.mem_base=0x3ec00000 vc_mem.mem_size=0x40000000 dwc_otg.fiq_enable=0 dwc_otg.fiq_fsm_enable=0 dwc_otg.nak_holdoff=0' \ No newline at end of file diff --git a/recipes-bsp/u-boot/u-boot_%.bbappend b/recipes-bsp/u-boot/u-boot_%.bbappend index 78b3e484a..d5d74c502 100644 --- a/recipes-bsp/u-boot/u-boot_%.bbappend +++ b/recipes-bsp/u-boot/u-boot_%.bbappend @@ -2,16 +2,33 @@ FILESEXTRAPATHS:prepend := "${THISDIR}/files:" SRC_URI:append:rpi = " \ file://fw_env.config \ + file://u-boot_rpi3_env \ " -SRC_URI:append:rpi = " file://0001-rpi-always-set-fdt_addr-with-firmware-provided-FDT-address.patch" +SRC_URI:append:rpi = " \ + file://0001-rpi-always-set-fdt_addr-with-firmware-provided-FDT-address.patch \ + file://myconfig.cfg \ + " DEPENDS:append:rpi = " u-boot-default-script" +do_compile:append:rpi(){ + ${B}/tools/mkenvimage -s 0x4000 -o ${B}/uboot.env ${WORKDIR}/u-boot_rpi3_env +} + do_install:append:rpi () { install -d ${D}${sysconfdir} install -m 0644 ${WORKDIR}/fw_env.config ${D}${sysconfdir}/fw_env.config + + install -d 644 ${D}${nonarch_base_libdir}/firmware + install -m 0644 ${B}/u-boot.bin ${D}${nonarch_base_libdir}/firmware/u-boot.bin +} + +do_deploy:append:rpi(){ + install -d ${DEPLOYDIR}/${BOOTFILES_DIR_NAME} + cp ${B}/uboot.env ${DEPLOYDIR}/${BOOTFILES_DIR_NAME}/uboot.env } +FILES:${PN}:append:rpi = " ${nonarch_base_libdir}/firmware/u-boot.bin" # Temporary avoid Raspberry Pi 5 because U-Boot has not been ported yet COMPATIBLE_MACHINE:raspberrypi5 = "(-)" diff --git a/recipes-core/images/rpi-test-image.bb b/recipes-core/images/rpi-test-image.bb index 360b20dc7..27836bdd5 100644 --- a/recipes-core/images/rpi-test-image.bb +++ b/recipes-core/images/rpi-test-image.bb @@ -3,4 +3,5 @@ include recipes-core/images/core-image-base.bb COMPATIBLE_MACHINE = "^rpi$" -IMAGE_INSTALL:append = " packagegroup-rpi-test" +IMAGE_INSTALL:append = " systemd systemd-analyze systemd-boot packagegroup-rpi-test" +VIRTUAL-RUNTIME_initscripts = "" diff --git a/recipes-core/packagegroups/packagegroup-rpi-test.bb b/recipes-core/packagegroups/packagegroup-rpi-test.bb index ff8f8a4d6..15d382ae3 100644 --- a/recipes-core/packagegroups/packagegroup-rpi-test.bb +++ b/recipes-core/packagegroups/packagegroup-rpi-test.bb @@ -11,23 +11,11 @@ COMPATIBLE_MACHINE = "^rpi$" OMXPLAYER = "${@bb.utils.contains('MACHINE_FEATURES', 'vc4graphics', '', 'omxplayer', d)}" RDEPENDS:${PN} = "\ - ${OMXPLAYER} \ - bcm2835-tests \ - raspi-gpio \ - rpio \ - rpi-gpio \ - pi-blaster \ - python3-adafruit-circuitpython-register \ - python3-adafruit-platformdetect \ - python3-adafruit-pureio \ - python3-rtimu \ - connman \ - connman-client \ - wireless-regdb-static \ - bluez5 \ -" - -RRECOMMENDS:${PN} = "\ - ${@bb.utils.contains("BBFILE_COLLECTIONS", "meta-multimedia", "bigbuckbunny-1080p bigbuckbunny-480p bigbuckbunny-720p", "", d)} \ - ${MACHINE_EXTRA_RRECOMMENDS} \ + optee-os \ + optee-test \ + optee-client \ + optee-examples \ + fscryptctl \ + keyutils \ + e2fsprogs-tune2fs \ " diff --git a/recipes-kernel/linux/files/fscypt.cfg b/recipes-kernel/linux/files/fscypt.cfg new file mode 100644 index 000000000..a4c112e92 --- /dev/null +++ b/recipes-kernel/linux/files/fscypt.cfg @@ -0,0 +1,28 @@ +# Common configurations for supporting Filesystem Encryption (using fscrypt) in the Linux kernel for Raspberry Pi 3b+ + +# For debugging +CONFIG_IKCONFIG=y +CONFIG_IKCONFIG_PROC=y + +# Master crypto framework - NOT auto-selected by anything +CONFIG_CRYPTO=y + +# Basic key management - NOT auto-selected by crypto algorithms +CONFIG_KEYS=y + +# File-Based Encryption (fscrypt) specific configurations + +# Core crypto algorithms (with massive auto-selection) +CONFIG_CRYPTO_AES=y +CONFIG_CRYPTO_XTS=y +CONFIG_CRYPTO_CTS=y +CONFIG_CRYPTO_SHA256=y + +# fscrypt framework (not in this Kconfig - likely in fs/Kconfig) +CONFIG_FS_ENCRYPTION=y +CONFIG_FS_ENCRYPTION_ALGS=y +CONFIG_EXT4_FS_ENCRYPTION=y + +# Key management for fscrypt +CONFIG_TRUSTED_KEYS=y +CONFIG_ENCRYPTED_KEYS=y \ No newline at end of file diff --git a/recipes-kernel/linux/files/optee_dtb_entry.patch b/recipes-kernel/linux/files/optee_dtb_entry.patch new file mode 100644 index 000000000..b6c812eb6 --- /dev/null +++ b/recipes-kernel/linux/files/optee_dtb_entry.patch @@ -0,0 +1,15 @@ +diff --git a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts +index 5f248fb01bca..af815ed5ad83 100644 +--- a/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts ++++ b/arch/arm/boot/dts/bcm2710-rpi-3-b-plus.dts +@@ -175,6 +175,10 @@ expgpio: expgpio { + "NC"; + status = "okay"; + }; ++ optee { ++ compatible = "linaro,optee-tz"; ++ method = "smc"; ++ }; + }; + + &uart0 { diff --git a/recipes-kernel/linux/files/tee-driver.cfg b/recipes-kernel/linux/files/tee-driver.cfg new file mode 100644 index 000000000..cc71adb7d --- /dev/null +++ b/recipes-kernel/linux/files/tee-driver.cfg @@ -0,0 +1,2 @@ +CONFIG_TEE=y +CONFIG_OPTEE=y \ No newline at end of file diff --git a/recipes-kernel/linux/linux-raspberrypi_5.15.bb b/recipes-kernel/linux/linux-raspberrypi_5.15.bb index 6e000350e..3bee3de77 100644 --- a/recipes-kernel/linux/linux-raspberrypi_5.15.bb +++ b/recipes-kernel/linux/linux-raspberrypi_5.15.bb @@ -14,6 +14,9 @@ SRC_URI = " \ file://0002-wifi-cfg80211-fix-certs-build-to-not-depend-on-file-.patch \ file://powersave.cfg \ file://android-drivers.cfg \ + file://tee-driver.cfg \ + file://optee_dtb_entry.patch \ + file://fscrypt.cfg \ " require linux-raspberrypi.inc diff --git a/recipes-security/fscryptctl/files/0001-support-trusted-keys-TA-access-from-userspace.patch b/recipes-security/fscryptctl/files/0001-support-trusted-keys-TA-access-from-userspace.patch new file mode 100644 index 000000000..34aef7884 --- /dev/null +++ b/recipes-security/fscryptctl/files/0001-support-trusted-keys-TA-access-from-userspace.patch @@ -0,0 +1,426 @@ +diff --git a/Makefile b/Makefile +index 9b28c8c..4ade46a 100644 +--- a/Makefile ++++ b/Makefile +@@ -44,16 +44,29 @@ LDFLAGS ?= + VERSION ?= $(shell git describe --tags 2>/dev/null) + override CPPFLAGS += $(if $(VERSION),-DVERSION="\"$(VERSION)\"") + ++CFG_TRUSTED_KEYS ?= n ++ifeq ($(CFG_TRUSTED_KEYS),y) ++ ifeq ($(TEEC_EXPORT),) ++ $(error "TEEC_EXPORT is required") ++ endif ++ override CFLAGS += -DTRUSTED_KEYS -I$(TEEC_EXPORT)/include ++ override LDADD += -lteec -L$(TEEC_EXPORT)/lib ++endif ++ ++ + ############################################################################## + + # Build the binary + +-SRC := $(wildcard *.c) ++SRC := fscryptctl.c ++ifeq ($(CFG_TRUSTED_KEYS),y) ++ SRC += trusted_keys.c ++endif + OBJ := $(SRC:.c=.o) + HDRS := $(wildcard *.h) + + fscryptctl: $(OBJ) +- $(CC) -o $@ $(CFLAGS) $(LDFLAGS) $+ ++ $(CC) -o $@ $(CFLAGS) $^ $(LDFLAGS) $(LDADD) + + $(OBJ): %.o: %.c $(HDRS) + $(CC) -o $@ -c $(CPPFLAGS) $(CFLAGS) $< +diff --git a/fscryptctl.c b/fscryptctl.c +index 801ea5d..9c59b2a 100644 +--- a/fscryptctl.c ++++ b/fscryptctl.c +@@ -88,6 +88,108 @@ static void wipe_and_free(void *v, size_t n) { + #define FSCRYPT_KEY_DESCRIPTOR_HEX_SIZE ((2 * FSCRYPT_KEY_DESCRIPTOR_SIZE) + 1) + #define FSCRYPT_KEY_IDENTIFIER_HEX_SIZE ((2 * FSCRYPT_KEY_IDENTIFIER_SIZE) + 1) + ++#if defined(TRUSTED_KEYS) ++#include "trusted_keys.h" ++ ++static int string_to_trusted_key_size(uint32_t *key_size, const char *str) { ++ int istr; ++ ++ if (!key_size || !str) { ++ return -EINVAL; ++ } ++ ++ istr = atoi(str); ++ if (istr < FSCRYPT_MIN_KEY_SIZE || istr > FSCRYPT_MAX_KEY_SIZE || ++ istr < TRUSTED_KEYS_MIN_KEY_SIZE || istr > TRUSTED_KEYS_MAX_KEY_SIZE) { ++ return -EINVAL; ++ } ++ ++ *key_size = (uint32_t)istr; ++ return 0; ++} ++ ++static int trusted_keys_write(const char *filename, const char *key, uint32_t key_size) { ++ size_t wsz; ++ FILE *fp = NULL; ++ int r = 0; ++ char blob[TRUSTED_KEYS_MAX_BLOB_SIZE]; ++ size_t blob_size = sizeof(blob); ++ ++ if (trusted_keys_seal(blob, &blob_size, key, key_size) < 0) { ++ return -EFAULT; ++ } ++ ++ fp = fopen(filename, "w"); ++ if (!fp) { ++ return -errno; ++ } ++ ++ wsz = fwrite(blob, 1, blob_size, fp); ++ if (wsz != blob_size) { ++ r = -EIO; ++ } ++ ++cleanup: ++ if (fp) { ++ fclose(fp); ++ } ++ return r; ++} ++ ++static int trusted_keys_read(const char *filename, char *key, uint32_t *key_size) { ++ long tsz; ++ size_t rsz; ++ size_t ksz = *key_size; ++ FILE *fp = fopen(filename, "r"); ++ int r = 0; ++ char blob[TRUSTED_KEYS_MAX_BLOB_SIZE]; ++ ++ if (!fp) { ++ return -errno; ++ } ++ ++ if (fseek(fp, 0, SEEK_END) < 0) { ++ r = -errno; ++ goto cleanup; ++ } ++ ++ tsz = ftell(fp); ++ if (tsz < 0) { ++ r = -errno; ++ goto cleanup; ++ } ++ ++ if (TRUSTED_KEYS_MAX_BLOB_SIZE < (size_t)tsz) { ++ r = -EINVAL; ++ goto cleanup; ++ } ++ ++ if (fseek(fp, 0, SEEK_SET) < 0) { ++ r = -errno; ++ goto cleanup; ++ } ++ ++ rsz = fread(blob, 1, tsz, fp); ++ if (rsz != tsz) { ++ r = -EIO; ++ goto cleanup; ++ } ++ ++ if (trusted_keys_unseal(key, &ksz, blob, rsz) < 0) { ++ r = -EFAULT; ++ } ++ ++ *key_size = (uint32_t)ksz; ++ ++cleanup: ++ if (fp) { ++ fclose(fp); ++ } ++ return r; ++} ++#endif ++ ++ + // Human-readable strings for encryption modes, indexed by the encryption mode + static const char *const mode_strings[] = { + [FSCRYPT_MODE_AES_256_XTS] = "AES-256-XTS", +@@ -113,6 +215,10 @@ enum { + OPT_IV_INO_LBLK_32, + OPT_IV_INO_LBLK_64, + OPT_PADDING, ++#if defined(TRUSTED_KEYS) ++ OPT_GENERATE_TRUSTED_KEY, ++ OPT_TRUSTED_KEY_FILENAME, ++#endif + }; + + /* util-linux style usage */ +@@ -147,9 +253,18 @@ static void __attribute__((__noreturn__)) usage(FILE *out) { + " print this help screen\n" + " -v, --version\n" + " print the version of fscryptctl\n" ++ // " add_key\n" ++ // " --hw-wrapped-key\n" ++ // " add a hardware-wrapped key (rather than a raw key)\n" ++#if defined(TRUSTED_KEYS) + " add_key\n" +- " --hw-wrapped-key\n" +- " add a hardware-wrapped key (rather than a raw key)\n" ++ " --generate-trusted-key=\n" ++ " generate a trusted key and use it.\n" ++ " --trusted-key-filename=\n" ++ " read a encrypted trusted key from the file.\n" ++ " if it used with --generate-trusted-key, the generated trusted\n" ++ " key is written in the file.\n" ++#endif + " remove_key\n" + " --all-users\n" + " force-remove all users' claims to the key (requires root)\n" +@@ -437,8 +552,16 @@ static bool set_policy(const char *path, + // ----------------------------------------------------------------------------- + + static int cmd_add_key(int argc, char *const argv[]) { ++#if defined(TRUSTED_KEYS) ++ uint32_t trusted_key_size = 0; ++ char *trusted_key_filename = NULL; ++#endif + static const struct option add_key_options[] = { + {"hw-wrapped-key", no_argument, NULL, OPT_HW_WRAPPED_KEY}, ++#if defined(TRUSTED_KEYS) ++ {"generate-trusted-key", required_argument, NULL, OPT_GENERATE_TRUSTED_KEY}, ++ {"trusted-key-filename", required_argument, NULL, OPT_TRUSTED_KEY_FILENAME}, ++#endif + {NULL, 0, NULL, 0}}; + int max_size = FSCRYPT_MAX_KEY_SIZE; + __u32 flags = 0; +@@ -450,6 +573,23 @@ static int cmd_add_key(int argc, char *const argv[]) { + flags |= FSCRYPT_ADD_KEY_FLAG_HW_WRAPPED; + max_size = MAX_WRAPPED_KEY_SIZE; + break; ++#if defined(TRUSTED_KEYS) ++ case OPT_GENERATE_TRUSTED_KEY: ++ if (string_to_trusted_key_size(&trusted_key_size, optarg) < 0) { ++ fputs("error: invalid trusted key size\n", stderr); ++ free(trusted_key_filename); ++ return EXIT_FAILURE; ++ } ++ break; ++ case OPT_TRUSTED_KEY_FILENAME: ++ free(trusted_key_filename); ++ trusted_key_filename = strdup(optarg); ++ if (!trusted_key_filename) { ++ fputs("error: failed to allocate memory\n", stderr); ++ return EXIT_FAILURE; ++ } ++ break; ++#endif + default: + usage(stderr); + } +@@ -464,6 +604,27 @@ static int cmd_add_key(int argc, char *const argv[]) { + + struct fscrypt_add_key_arg *arg = xzalloc(sizeof(*arg) + max_size); + int status = EXIT_FAILURE; ++#if defined(TRUSTED_KEYS) ++ if (trusted_key_filename) { ++ if (trusted_key_size > 0) { ++ arg->raw_size = trusted_key_size; ++ if (trusted_keys_generate((char *)arg->raw, arg->raw_size) < 0) { ++ fputs("error: failed to generate a trusted key\n", stderr); ++ goto cleanup; ++ } ++ if (trusted_keys_write(trusted_key_filename, (char *)arg->raw, arg->raw_size) < 0) { ++ fputs("error: failed to save a trusted key blob\n", stderr); ++ goto cleanup; ++ } ++ } else { ++ arg->raw_size = FSCRYPT_MAX_KEY_SIZE; ++ if (trusted_keys_read(trusted_key_filename, (char *)arg->raw, &arg->raw_size) < 0) { ++ fputs("error: failed to load a trusted key blob\n", stderr); ++ goto cleanup; ++ } ++ } ++ } else ++#endif + arg->raw_size = read_key(arg->raw, max_size); + if (arg->raw_size == 0) { + goto cleanup; +@@ -490,6 +651,9 @@ static int cmd_add_key(int argc, char *const argv[]) { + puts(identifier_hex); + status = EXIT_SUCCESS; + cleanup: ++#if defined(TRUSTED_KEYS) ++ free(trusted_key_filename); ++#endif + wipe_and_free(arg, sizeof(*arg) + max_size); + return status; + } +diff --git a/trusted_keys.c b/trusted_keys.c +new file mode 100644 +index 0000000..dd2f619 +--- /dev/null ++++ b/trusted_keys.c +@@ -0,0 +1,139 @@ ++#include ++#include ++#include ++#include ++#include ++ ++#include ++ ++#include "trusted_keys.h" ++ ++#define TA_TRUSTED_KEYS_UUID \ ++ { 0xf04a0fe7, 0x1f5d, 0x4b9b, \ ++ {0xab, 0xf7, 0x61, 0x9b, 0x85, 0xb4, 0xce, 0x8c } } ++ ++#define TA_CMD_GET_RANDOM 0x0 ++#define TA_CMD_SEAL 0x1 ++#define TA_CMD_UNSEAL 0x2 ++ ++#define TA_CMD_GET_RANDOM 0x0 ++#define TA_CMD_SEAL 0x1 ++#define TA_CMD_UNSEAL 0x2 ++ ++static TEEC_Result teec_invoke_command(const char *tag, uint32_t cmd, TEEC_Operation *op) ++{ ++ TEEC_Result r = TEEC_SUCCESS; ++ TEEC_Context ctx; ++ TEEC_Session sess; ++ TEEC_UUID uuid = TA_TRUSTED_KEYS_UUID; ++ uint32_t err = 0; ++ ++ r = TEEC_InitializeContext(NULL, &ctx); ++ if (r != TEEC_SUCCESS) { ++ fprintf(stderr, "%s: Failed to TEEC_InitializeContext: 0x%x\n", tag, r); ++ return r; ++ } ++ ++ r = TEEC_OpenSession(&ctx, &sess, &uuid, TEEC_LOGIN_PUBLIC, NULL, NULL, &err); ++ if (r != TEEC_SUCCESS) { ++ fprintf(stderr, "%s: Failed to TEEC_OpenSession: 0x%x, err_origin: 0x%x\n", tag, r, err); ++ TEEC_FinalizeContext(&ctx); ++ return r; ++ } ++ ++ r = TEEC_InvokeCommand(&sess, cmd, op, &err); ++ if (r != TEEC_SUCCESS) { ++ fprintf(stderr, "%s: Failed to TEEC_InvokeCommand: 0x%x, err_origin: 0x%x\n", tag, r, err); ++ } ++ ++ TEEC_CloseSession(&sess); ++ TEEC_FinalizeContext(&ctx); ++ ++ return r; ++} ++ ++int trusted_keys_generate(char *key, size_t key_size) ++{ ++ TEEC_Operation op; ++ ++ if (!key || key_size < TRUSTED_KEYS_MIN_KEY_SIZE || key_size > TRUSTED_KEYS_MAX_KEY_SIZE) { ++ return -EINVAL; ++ } ++ ++ memset(&op, 0, sizeof(op)); ++ op.paramTypes = TEEC_PARAM_TYPES(TEEC_MEMREF_TEMP_OUTPUT, ++ TEEC_NONE, ++ TEEC_NONE, ++ TEEC_NONE); ++ op.params[0].tmpref.buffer = (void *)key; ++ op.params[0].tmpref.size = key_size; ++ ++ return teec_invoke_command(__FUNCTION__, TA_CMD_GET_RANDOM, &op) != TEEC_SUCCESS ? -EFAULT : 0; ++} ++ ++int trusted_keys_seal(char *blob, size_t *blob_size, const char *key, size_t key_size) ++{ ++ TEEC_Result r = TEEC_SUCCESS; ++ TEEC_Operation op; ++ ++ if (!blob || *blob_size > TRUSTED_KEYS_MAX_BLOB_SIZE) { ++ return -EINVAL; ++ } ++ ++ if (!key || key_size < TRUSTED_KEYS_MIN_KEY_SIZE || key_size > TRUSTED_KEYS_MAX_KEY_SIZE) { ++ return -EINVAL; ++ } ++ ++ memset(&op, 0, sizeof(op)); ++ op.paramTypes = TEEC_PARAM_TYPES(TEEC_MEMREF_TEMP_INPUT, ++ TEEC_MEMREF_TEMP_OUTPUT, ++ TEEC_NONE, ++ TEEC_NONE); ++ op.params[0].tmpref.buffer = (void *)key; ++ op.params[0].tmpref.size = key_size; ++ op.params[1].tmpref.buffer = (void *)blob; ++ op.params[1].tmpref.size = *blob_size; ++ ++ r = teec_invoke_command(__FUNCTION__, TA_CMD_SEAL, &op); ++ ++ if (r != TEEC_SUCCESS) { ++ return -EFAULT; ++ } ++ ++ *blob_size = op.params[1].tmpref.size; ++ ++ return 0; ++} ++ ++int trusted_keys_unseal(char *key, size_t *key_size, const char *blob, size_t blob_size) ++{ ++ TEEC_Result r = TEEC_SUCCESS; ++ TEEC_Operation op; ++ ++ if (!key || *key_size < TRUSTED_KEYS_MIN_KEY_SIZE || *key_size > TRUSTED_KEYS_MAX_KEY_SIZE) { ++ return -EINVAL; ++ } ++ ++ if (!blob || blob_size > TRUSTED_KEYS_MAX_BLOB_SIZE) { ++ return -EINVAL; ++ } ++ ++ memset(&op, 0, sizeof(op)); ++ op.paramTypes = TEEC_PARAM_TYPES(TEEC_MEMREF_TEMP_INPUT, ++ TEEC_MEMREF_TEMP_OUTPUT, ++ TEEC_NONE, ++ TEEC_NONE); ++ op.params[0].tmpref.buffer = (void *)blob; ++ op.params[0].tmpref.size = blob_size; ++ op.params[1].tmpref.buffer = (void *)key; ++ op.params[1].tmpref.size = *key_size; ++ ++ r = teec_invoke_command(__FUNCTION__, TA_CMD_UNSEAL, &op); ++ if (r != TEEC_SUCCESS) { ++ return -EFAULT; ++ } ++ ++ *key_size = op.params[1].tmpref.size; ++ ++ return 0; ++} +diff --git a/trusted_keys.h b/trusted_keys.h +new file mode 100644 +index 0000000..3b8848a +--- /dev/null ++++ b/trusted_keys.h +@@ -0,0 +1,15 @@ ++#ifndef FSCRYPT_TRUSTED_KEYS_H ++#define FSCRYPT_TRUSTED_KEYS_H ++ ++#include ++#include ++ ++#define TRUSTED_KEYS_MIN_KEY_SIZE 32 ++#define TRUSTED_KEYS_MAX_KEY_SIZE 128 ++#define TRUSTED_KEYS_MAX_BLOB_SIZE 512 ++ ++int trusted_keys_generate(char *key, size_t key_size); ++int trusted_keys_seal(char *blob, size_t *blob_size, const char *key, size_t key_size); ++int trusted_keys_unseal(char *key, size_t *key_size, const char *blob, size_t blob_size); ++ ++#endif /* FSCRYPT_TRUSTED_KEYS_H */ diff --git a/recipes-security/fscryptctl/fscryptctl_1.3.0.bb b/recipes-security/fscryptctl/fscryptctl_1.3.0.bb new file mode 100644 index 000000000..79537595a --- /dev/null +++ b/recipes-security/fscryptctl/fscryptctl_1.3.0.bb @@ -0,0 +1,33 @@ +SUMMARY = "fscryptctl - Linux filesystem encryption utility" +DESCRIPTION = "Command-line tool for managing Linux filesystem encryption" +HOMEPAGE = "https://github.com/google/fscryptctl" +LICENSE = "Apache-2.0" +LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57" + +FILESEXTRAPATHS:prepend := "${THISDIR}/files:" + +SRC_URI = "git://github.com/google/fscryptctl.git;protocol=https;branch=master" +SRCREV = "f1ec919877f6b5360c03fdb44b6ed8a47aa459e8" + +SRC_URI += "file://0001-support-trusted-keys-TA-access-from-userspace.patch" + +S = "${WORKDIR}/git" + +DEPENDS = "libcap-ng" +inherit pkgconfig + +DEPENDS += "optee-client" +RDEPENDS:${PN} += "optee-client" + +EXTRA_OEMAKE += "CFG_TRUSTED_KEYS=y TEEC_EXPORT=${STAGING_DIR_HOST}${prefix}" + +do_compile() { + oe_runmake fscryptctl +} + +do_install() { + oe_runmake install-bin DESTDIR=${D} BINDIR=${bindir} +} + +FILES:${PN} = "${bindir}/fscryptctl" +COMPATIBLE_MACHINE = "^rpi$"