[ptxdist] [PATCH v3] tf-a: new package for ARM trusted firmware A

[ptxdist] [PATCH v3] tf-a: new package for ARM trusted firmware A

[Ahmad Fatoum]

Trusted Firmware-A (TF-A) is a reference implementation of secure world
software for Arm A-Profile architectures (Armv8-A and Armv7-A).

Cc: Alejandro Vazquez <avazquez.dev@gmail.com>
Signed-off-by: Rouven Czerwinski <rouven@czerwinskis.de>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
v2 -> v3:
  - sorted version and md5 Kconfig options to top (mol)
  - Added trailing spaces to align arrow after main prompt (mol)
  - Changed TF_A_VERSION help text to indicate that the version can be any
    git commitsh
  - Removed default value for TF_A_ARTIFACTS (mol)
  - integrated TF_A_VERSION into BUILD_STRING of resulting artifacts
    (Guillermo, mtr)
  - unconditional error if TF_A_ARTIFACTS is empty instead of warning later on
    (mol)
  - removed diplicate Prepare header (mol)
  - resorted make variable definitions
  - avoid unportable install --target-directory (Guillermo)
  - documented support for globbing in TF_A_ARTIFACTS
  - don't glob delete in IMAGEDIR, instead expand the glob in the build
    directory first
v1 -> v2:
  - Made TF_A_ARCH_MAJOR configurable to support 32 bit ARMv8 (Guillermo)
  - Replaces stm32mp-specific TF_A_DTB with TF_A_EXTRA_ARGS to contain
    all board/vendor specific options
  - removed reference to no longer existing CREDITS file
  - removed TF_A_MAKE_OPT contents that are set elsewhere
  - reduced uses of += in favor of directly appending to the string
  - delete old build directory in prepare instead of compile
  - use default compile stage (Guillermo)
  - install artifacts to sysroot /usr/lib/firmware in install stage
  - install artifacts to IMAGEDIR in targetinstall
  - fix clean stage to delete proper artifacts
---
 platforms/tf-a.in | 140 ++++++++++++++++++++++++++++++++++++++++++++++
 rules/tf-a.make   | 118 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 258 insertions(+)
 create mode 100644 platforms/tf-a.in
 create mode 100644 rules/tf-a.make

diff --git a/platforms/tf-a.in b/platforms/tf-a.in
new file mode 100644
index 000000000000..75dad9d159f4
--- /dev/null
+++ b/platforms/tf-a.in
@@ -0,0 +1,140 @@
+## SECTION=bootloader
+
+menuconfig TF_A
+	select BOOTLOADER
+	prompt "ARM Trusted Firmware-A        "
+	depends on ARCH_ARM || ARCH_ARM64
+	bool
+
+if TF_A
+
+config TF_A_VERSION
+	string
+	default "v2.2"
+	prompt "TF-A version"
+	help
+	  Enter the TF-A git commitsh you want to build. Usally a tagged release
+	  like "v2.2"
+
+config TF_A_MD5
+	string
+	default "bb300e5a62c911e189c80d935d497a4b"
+	prompt "TF-A source md5"
+
+config TF_A_ARCH_STRING
+        string
+        default "aarch32" if ARCH_ARM
+        default "aarch64" if ARCH_ARM64
+
+choice
+	prompt "TF-A Architecture"
+	default TF_A_ARM_ARCH_MAJOR_7 if ARCH_ARM
+	default TF_A_ARM_ARCH_MAJOR_8 if ARCH_ARM64
+	help
+	  Architecture version major number
+
+	config TF_A_ARM_ARCH_MAJOR_7
+		depends on ARCH_ARM
+		prompt "ARMv7"
+		bool
+
+	config TF_A_ARM_ARCH_MAJOR_8_32_BIT
+		depends on ARCH_ARM
+		prompt "ARMv8 32-bit"
+		bool
+
+	config TF_A_ARM_ARCH_MAJOR_8
+		depends on ARCH_ARM64
+		prompt "ARMv8"
+		bool
+
+endchoice
+
+config TF_A_ARM_ARCH_MAJOR
+        int
+        default 7 if TF_A_ARM_ARCH_MAJOR_7
+        default 8 if TF_A_ARM_ARCH_MAJOR_8_32_BIT
+        default 8 if TF_A_ARM_ARCH_MAJOR_8
+
+
+config TF_A_PLATFORM
+	string
+	prompt "TF-A target platform"
+	help
+	  The TF-A target platform.
+
+config TF_A_ARM_ARCH_MINOR
+	depends on TF_A_ARM_ARCH_MAJOR_8 || TF_A_ARM_ARCH_MAJOR_8_32_BIT
+	int
+	default 0
+	prompt "TF-A target ARMv8.MINOR version"
+	help
+	  The minor version of the ARMv8 architecture targeted. Defaults to 0.
+
+config TF_A_EXTRA_ARGS
+	string
+	prompt "TF-A extra build arguments"
+	help
+	  Extra platform-specific build arguments to pass to the TF-A build
+	  process, e.g. DTB_FILE_NAME= for the stm32mp1
+
+config TF_A_ARTIFACTS
+	string
+	prompt "TF-A artifact file names"
+	help
+	  A space-separated list of glob patterns of artifacts to copy from the
+	  build directory.
+	  All file names are relative to the appropriate TF-A platform build
+	  directory.
+
+comment "Payloads"
+
+choice
+	prompt "BL32 Payload"
+	default TF_A_BL32_NONE
+	help
+	  payload for BL32 (Secure World OS)
+
+	config TF_A_BL32_NONE
+		prompt "None"
+		bool
+
+	config TF_A_BL32_SP_MIN
+		depends on ARCH_ARM
+		prompt "sp_min"
+		bool
+
+	config TF_A_BL32_TSP
+		depends on ARCH_ARM64
+		prompt "Test Secure Payload"
+		bool
+
+endchoice
+
+if TF_A_BL32_TSP
+choice TF_A_BL32_TSP_RAM_LOCATION
+	prompt "TSP location"
+	default TF_A_BL32_TSP_RAM_LOCATION_TSRAM
+
+	config TF_A_BL32_TSP_RAM_LOCATION_TSRAM
+		prompt "Trusted SRAM"
+		bool
+
+	config TF_A_BL32_TSP_RAM_LOCATION_TDRAM
+		prompt "Trusted DRAM (if available)"
+		bool
+
+	config TF_A_BL32_TSP_RAM_LOCATION_DRAM
+		prompt "Secure DRAM region (configured by TrustZone controller)"
+		bool
+endchoice
+
+config TF_A_BL32_TSP_RAM_LOCATION_STRING
+        string
+        default "tsram" if TF_A_BL32_TSP_RAM_LOCATION_TSRAM
+        default "tdram" if TF_A_BL32_TSP_RAM_LOCATION_TDRAM
+        default "dram"  if TF_A_BL32_TSP_RAM_LOCATION_DRAM
+
+endif
+
+endif
diff --git a/rules/tf-a.make b/rules/tf-a.make
new file mode 100644
index 000000000000..bb7ba9e96822
--- /dev/null
+++ b/rules/tf-a.make
@@ -0,0 +1,118 @@
+# -*-makefile-*-
+#
+# Copyright (C) 2018 by Rouven Czerwinski <r.czerwinski@pengutronix.de>
+#               2019 by Ahmad Fatoum <a.fatoum@pengutronix.de>
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+#
+# We provide this package
+#
+PACKAGES-$(PTXCONF_TF_A) += tf-a
+
+#
+# Paths and names
+#
+TF_A_VERSION	:= $(call remove_quotes,$(PTXCONF_TF_A_VERSION))
+TF_A_MD5	:= $(call remove_quotes,$(PTXCONF_TF_A_MD5))
+TF_A		:= tf-a-$(TF_A_VERSION)
+TF_A_SUFFIX	:= tar.gz
+TF_A_URL	:= https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/snapshot/$(TF_A_VERSION).$(TF_A_SUFFIX)
+TF_A_SOURCE	:= $(SRCDIR)/$(TF_A).$(TF_A_SUFFIX)
+TF_A_DIR	:= $(BUILDDIR)/$(TF_A)
+TF_A_LICENSE    := BSD-3-Clause
+
+# ----------------------------------------------------------------------------
+# Prepare
+# ----------------------------------------------------------------------------
+
+TF_A_WRAPPER_BLACKLIST := \
+	TARGET_HARDEN_RELRO \
+	TARGET_HARDEN_BINDNOW \
+	TARGET_HARDEN_PIE \
+	TARGET_DEBUG \
+	TARGET_BUILD_ID
+
+# TF_A_DEBUG=1
+
+TF_A_PATH	:= PATH=$(CROSS_PATH)
+TF_A_MAKE_OPT	:= \
+	CROSS_COMPILE=$(BOOTLOADER_CROSS_COMPILE) \
+	HOSTCC=$(HOSTCC) \
+	PLAT=$(PTXCONF_TF_A_PLATFORM) \
+	DEBUG=$(call ptx/ifdef,TF_A_DEBUG,1,0) \
+	ARCH=$(PTXCONF_TF_A_ARCH_STRING) \
+	ARM_ARCH_MAJOR=$(PTXCONF_TF_A_ARM_ARCH_MAJOR) \
+	BUILD_STRING=$(PTXCONF_TF_A_VERSION) \
+	$(call remove_quotes,$(PTXCONF_TF_A_EXTRA_ARGS)) \
+	all
+
+ifdef PTXCONF_TF_A_BL32_TSP
+TF_A_MAKE_OPT += ARM_TSP_RAM_LOCATION=$(PTXCONF_TF_A_BL32_TSP_RAM_LOCATION_STRING)
+endif
+ifdef PTXCONF_TF_A_ARM_ARCH_MINOR
+TF_A_MAKE_OPT += ARM_ARCH_MINOR=$(PTXCONF_TF_A_ARM_ARCH_MINOR)
+endif
+ifdef PTXCONF_TF_A_BL32_SP_MIN
+TF_A_MAKE_OPT += AARCH32_SP=sp_min
+endif
+
+ifdef PTXCONF_TF_A
+ifeq ($(PTXCONF_TF_A_ARTIFACTS),)
+$(error TF_A_ARTIFACTS is empty. nothing to install.)
+endif
+endif
+
+TF_A_CONF_TOOL	:= NO
+
+$(STATEDIR)/tf-a.prepare:
+	@$(call targetinfo)
+	@rm -rf $(TF_A_DIR)/build/
+	@$(call touch)
+
+# ----------------------------------------------------------------------------
+# Compile
+# ----------------------------------------------------------------------------
+
+TF_A_MAKE_ENV	:= $(CROSS_ENV)
+
+# ----------------------------------------------------------------------------
+# Install
+# ----------------------------------------------------------------------------
+
+TF_A_BUILD_OUTPUT_DIR := $(TF_A_DIR)/build/$(call remove_quotes, \
+	$(PTXCONF_TF_A_PLATFORM))/$(call ptx/ifdef,TF_A_DEBUG,debug,release)
+TF_A_ARTIFACTS_SRC = $(wildcard $(addprefix $(TF_A_BUILD_OUTPUT_DIR)/, \
+	$(call remove_quotes,$(PTXCONF_TF_A_ARTIFACTS))))
+TF_A_ARTIFACTS_DEST = $(subst $(TF_A_BUILD_OUTPUT_DIR)/,,$(TF_A_ARTIFACTS_SRC))
+
+$(STATEDIR)/tf-a.install:
+	@$(call targetinfo)
+	@$(foreach artifact, $(TF_A_ARTIFACTS_SRC), \
+		install -v -D -m 644 $(artifact) \
+		$(TF_A_PKGDIR)/usr/lib/firmware/$(notdir $(artifact))$(ptx/nl))
+	@$(call touch)
+
+# ----------------------------------------------------------------------------
+# Target-Install
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/tf-a.targetinstall:
+	@$(call targetinfo)
+	@$(foreach artifact, $(TF_A_ARTIFACTS_SRC), \
+		install -v -D -m 644 $(artifact) \
+		$(IMAGEDIR)/$(notdir $(artifact))$(ptx/nl))
+	@$(call touch)
+
+# ----------------------------------------------------------------------------
+# Clean
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/tf-a.clean:
+	@$(call targetinfo)
+	@rm -f $(addprefix $(IMAGEDIR)/, $(TF_A_ARTIFACTS_DEST))
+	@$(call clean_pkg, TF_A)
+
+# vim: syntax=make
-- 
2.25.0


_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCH v3] tf-a: new package for ARM trusted firmware A

[Michael Tretter]

On Wed, 19 Feb 2020 11:42:29 +0100, Ahmad Fatoum wrote:
> Trusted Firmware-A (TF-A) is a reference implementation of secure world
> software for Arm A-Profile architectures (Armv8-A and Armv7-A).
> 
> Cc: Alejandro Vazquez <avazquez.dev@gmail.com>
> Signed-off-by: Rouven Czerwinski <rouven@czerwinskis.de>
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

Tested-by: Michael Tretter <m.tretter@pengutronix.de>

> ---
> v2 -> v3:
>   - sorted version and md5 Kconfig options to top (mol)
>   - Added trailing spaces to align arrow after main prompt (mol)
>   - Changed TF_A_VERSION help text to indicate that the version can be any
>     git commitsh
>   - Removed default value for TF_A_ARTIFACTS (mol)
>   - integrated TF_A_VERSION into BUILD_STRING of resulting artifacts
>     (Guillermo, mtr)
>   - unconditional error if TF_A_ARTIFACTS is empty instead of warning later on
>     (mol)
>   - removed diplicate Prepare header (mol)
>   - resorted make variable definitions
>   - avoid unportable install --target-directory (Guillermo)
>   - documented support for globbing in TF_A_ARTIFACTS
>   - don't glob delete in IMAGEDIR, instead expand the glob in the build
>     directory first
> v1 -> v2:
>   - Made TF_A_ARCH_MAJOR configurable to support 32 bit ARMv8 (Guillermo)
>   - Replaces stm32mp-specific TF_A_DTB with TF_A_EXTRA_ARGS to contain
>     all board/vendor specific options
>   - removed reference to no longer existing CREDITS file
>   - removed TF_A_MAKE_OPT contents that are set elsewhere
>   - reduced uses of += in favor of directly appending to the string
>   - delete old build directory in prepare instead of compile
>   - use default compile stage (Guillermo)
>   - install artifacts to sysroot /usr/lib/firmware in install stage
>   - install artifacts to IMAGEDIR in targetinstall
>   - fix clean stage to delete proper artifacts
> ---
>  platforms/tf-a.in | 140 ++++++++++++++++++++++++++++++++++++++++++++++
>  rules/tf-a.make   | 118 ++++++++++++++++++++++++++++++++++++++
>  2 files changed, 258 insertions(+)
>  create mode 100644 platforms/tf-a.in
>  create mode 100644 rules/tf-a.make
> 
> diff --git a/platforms/tf-a.in b/platforms/tf-a.in
> new file mode 100644
> index 000000000000..75dad9d159f4
> --- /dev/null
> +++ b/platforms/tf-a.in
> @@ -0,0 +1,140 @@
> +## SECTION=bootloader
> +
> +menuconfig TF_A
> +	select BOOTLOADER
> +	prompt "ARM Trusted Firmware-A        "
> +	depends on ARCH_ARM || ARCH_ARM64
> +	bool
> +
> +if TF_A
> +
> +config TF_A_VERSION
> +	string
> +	default "v2.2"
> +	prompt "TF-A version"
> +	help
> +	  Enter the TF-A git commitsh you want to build. Usally a tagged release
> +	  like "v2.2"
> +
> +config TF_A_MD5
> +	string
> +	default "bb300e5a62c911e189c80d935d497a4b"
> +	prompt "TF-A source md5"
> +
> +config TF_A_ARCH_STRING
> +        string
> +        default "aarch32" if ARCH_ARM
> +        default "aarch64" if ARCH_ARM64
> +
> +choice
> +	prompt "TF-A Architecture"
> +	default TF_A_ARM_ARCH_MAJOR_7 if ARCH_ARM
> +	default TF_A_ARM_ARCH_MAJOR_8 if ARCH_ARM64
> +	help
> +	  Architecture version major number
> +
> +	config TF_A_ARM_ARCH_MAJOR_7
> +		depends on ARCH_ARM
> +		prompt "ARMv7"
> +		bool
> +
> +	config TF_A_ARM_ARCH_MAJOR_8_32_BIT
> +		depends on ARCH_ARM
> +		prompt "ARMv8 32-bit"
> +		bool
> +
> +	config TF_A_ARM_ARCH_MAJOR_8
> +		depends on ARCH_ARM64
> +		prompt "ARMv8"
> +		bool
> +
> +endchoice
> +
> +config TF_A_ARM_ARCH_MAJOR
> +        int
> +        default 7 if TF_A_ARM_ARCH_MAJOR_7
> +        default 8 if TF_A_ARM_ARCH_MAJOR_8_32_BIT
> +        default 8 if TF_A_ARM_ARCH_MAJOR_8
> +
> +
> +config TF_A_PLATFORM
> +	string
> +	prompt "TF-A target platform"
> +	help
> +	  The TF-A target platform.
> +
> +config TF_A_ARM_ARCH_MINOR
> +	depends on TF_A_ARM_ARCH_MAJOR_8 || TF_A_ARM_ARCH_MAJOR_8_32_BIT
> +	int
> +	default 0
> +	prompt "TF-A target ARMv8.MINOR version"
> +	help
> +	  The minor version of the ARMv8 architecture targeted. Defaults to 0.
> +
> +config TF_A_EXTRA_ARGS
> +	string
> +	prompt "TF-A extra build arguments"
> +	help
> +	  Extra platform-specific build arguments to pass to the TF-A build
> +	  process, e.g. DTB_FILE_NAME= for the stm32mp1
> +
> +config TF_A_ARTIFACTS
> +	string
> +	prompt "TF-A artifact file names"
> +	help
> +	  A space-separated list of glob patterns of artifacts to copy from the
> +	  build directory.
> +	  All file names are relative to the appropriate TF-A platform build
> +	  directory.
> +
> +comment "Payloads"
> +
> +choice
> +	prompt "BL32 Payload"
> +	default TF_A_BL32_NONE
> +	help
> +	  payload for BL32 (Secure World OS)
> +
> +	config TF_A_BL32_NONE
> +		prompt "None"
> +		bool
> +
> +	config TF_A_BL32_SP_MIN
> +		depends on ARCH_ARM
> +		prompt "sp_min"
> +		bool
> +
> +	config TF_A_BL32_TSP
> +		depends on ARCH_ARM64
> +		prompt "Test Secure Payload"
> +		bool
> +
> +endchoice
> +
> +if TF_A_BL32_TSP
> +choice TF_A_BL32_TSP_RAM_LOCATION
> +	prompt "TSP location"
> +	default TF_A_BL32_TSP_RAM_LOCATION_TSRAM
> +
> +	config TF_A_BL32_TSP_RAM_LOCATION_TSRAM
> +		prompt "Trusted SRAM"
> +		bool
> +
> +	config TF_A_BL32_TSP_RAM_LOCATION_TDRAM
> +		prompt "Trusted DRAM (if available)"
> +		bool
> +
> +	config TF_A_BL32_TSP_RAM_LOCATION_DRAM
> +		prompt "Secure DRAM region (configured by TrustZone controller)"
> +		bool
> +endchoice
> +
> +config TF_A_BL32_TSP_RAM_LOCATION_STRING
> +        string
> +        default "tsram" if TF_A_BL32_TSP_RAM_LOCATION_TSRAM
> +        default "tdram" if TF_A_BL32_TSP_RAM_LOCATION_TDRAM
> +        default "dram"  if TF_A_BL32_TSP_RAM_LOCATION_DRAM
> +
> +endif
> +
> +endif
> diff --git a/rules/tf-a.make b/rules/tf-a.make
> new file mode 100644
> index 000000000000..bb7ba9e96822
> --- /dev/null
> +++ b/rules/tf-a.make
> @@ -0,0 +1,118 @@
> +# -*-makefile-*-
> +#
> +# Copyright (C) 2018 by Rouven Czerwinski <r.czerwinski@pengutronix.de>
> +#               2019 by Ahmad Fatoum <a.fatoum@pengutronix.de>
> +#
> +# For further information about the PTXdist project and license conditions
> +# see the README file.
> +#
> +
> +#
> +# We provide this package
> +#
> +PACKAGES-$(PTXCONF_TF_A) += tf-a
> +
> +#
> +# Paths and names
> +#
> +TF_A_VERSION	:= $(call remove_quotes,$(PTXCONF_TF_A_VERSION))
> +TF_A_MD5	:= $(call remove_quotes,$(PTXCONF_TF_A_MD5))
> +TF_A		:= tf-a-$(TF_A_VERSION)
> +TF_A_SUFFIX	:= tar.gz
> +TF_A_URL	:= https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/snapshot/$(TF_A_VERSION).$(TF_A_SUFFIX)
> +TF_A_SOURCE	:= $(SRCDIR)/$(TF_A).$(TF_A_SUFFIX)
> +TF_A_DIR	:= $(BUILDDIR)/$(TF_A)
> +TF_A_LICENSE    := BSD-3-Clause
> +
> +# ----------------------------------------------------------------------------
> +# Prepare
> +# ----------------------------------------------------------------------------
> +
> +TF_A_WRAPPER_BLACKLIST := \
> +	TARGET_HARDEN_RELRO \
> +	TARGET_HARDEN_BINDNOW \
> +	TARGET_HARDEN_PIE \
> +	TARGET_DEBUG \
> +	TARGET_BUILD_ID
> +
> +# TF_A_DEBUG=1
> +
> +TF_A_PATH	:= PATH=$(CROSS_PATH)
> +TF_A_MAKE_OPT	:= \
> +	CROSS_COMPILE=$(BOOTLOADER_CROSS_COMPILE) \
> +	HOSTCC=$(HOSTCC) \
> +	PLAT=$(PTXCONF_TF_A_PLATFORM) \
> +	DEBUG=$(call ptx/ifdef,TF_A_DEBUG,1,0) \
> +	ARCH=$(PTXCONF_TF_A_ARCH_STRING) \
> +	ARM_ARCH_MAJOR=$(PTXCONF_TF_A_ARM_ARCH_MAJOR) \
> +	BUILD_STRING=$(PTXCONF_TF_A_VERSION) \
> +	$(call remove_quotes,$(PTXCONF_TF_A_EXTRA_ARGS)) \
> +	all
> +
> +ifdef PTXCONF_TF_A_BL32_TSP
> +TF_A_MAKE_OPT += ARM_TSP_RAM_LOCATION=$(PTXCONF_TF_A_BL32_TSP_RAM_LOCATION_STRING)
> +endif
> +ifdef PTXCONF_TF_A_ARM_ARCH_MINOR
> +TF_A_MAKE_OPT += ARM_ARCH_MINOR=$(PTXCONF_TF_A_ARM_ARCH_MINOR)
> +endif
> +ifdef PTXCONF_TF_A_BL32_SP_MIN
> +TF_A_MAKE_OPT += AARCH32_SP=sp_min
> +endif
> +
> +ifdef PTXCONF_TF_A
> +ifeq ($(PTXCONF_TF_A_ARTIFACTS),)
> +$(error TF_A_ARTIFACTS is empty. nothing to install.)
> +endif
> +endif
> +
> +TF_A_CONF_TOOL	:= NO
> +
> +$(STATEDIR)/tf-a.prepare:
> +	@$(call targetinfo)
> +	@rm -rf $(TF_A_DIR)/build/
> +	@$(call touch)
> +
> +# ----------------------------------------------------------------------------
> +# Compile
> +# ----------------------------------------------------------------------------
> +
> +TF_A_MAKE_ENV	:= $(CROSS_ENV)
> +
> +# ----------------------------------------------------------------------------
> +# Install
> +# ----------------------------------------------------------------------------
> +
> +TF_A_BUILD_OUTPUT_DIR := $(TF_A_DIR)/build/$(call remove_quotes, \
> +	$(PTXCONF_TF_A_PLATFORM))/$(call ptx/ifdef,TF_A_DEBUG,debug,release)
> +TF_A_ARTIFACTS_SRC = $(wildcard $(addprefix $(TF_A_BUILD_OUTPUT_DIR)/, \
> +	$(call remove_quotes,$(PTXCONF_TF_A_ARTIFACTS))))
> +TF_A_ARTIFACTS_DEST = $(subst $(TF_A_BUILD_OUTPUT_DIR)/,,$(TF_A_ARTIFACTS_SRC))
> +
> +$(STATEDIR)/tf-a.install:
> +	@$(call targetinfo)
> +	@$(foreach artifact, $(TF_A_ARTIFACTS_SRC), \
> +		install -v -D -m 644 $(artifact) \
> +		$(TF_A_PKGDIR)/usr/lib/firmware/$(notdir $(artifact))$(ptx/nl))
> +	@$(call touch)
> +
> +# ----------------------------------------------------------------------------
> +# Target-Install
> +# ----------------------------------------------------------------------------
> +
> +$(STATEDIR)/tf-a.targetinstall:
> +	@$(call targetinfo)
> +	@$(foreach artifact, $(TF_A_ARTIFACTS_SRC), \
> +		install -v -D -m 644 $(artifact) \
> +		$(IMAGEDIR)/$(notdir $(artifact))$(ptx/nl))
> +	@$(call touch)
> +
> +# ----------------------------------------------------------------------------
> +# Clean
> +# ----------------------------------------------------------------------------
> +
> +$(STATEDIR)/tf-a.clean:
> +	@$(call targetinfo)
> +	@rm -f $(addprefix $(IMAGEDIR)/, $(TF_A_ARTIFACTS_DEST))
> +	@$(call clean_pkg, TF_A)
> +
> +# vim: syntax=make

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCH v3] tf-a: new package for ARM trusted firmware A

[Philipp Zabel]

Hi,

On Wed, 2020-02-19 at 11:42 +0100, Ahmad Fatoum wrote:
> Trusted Firmware-A (TF-A) is a reference implementation of secure world
> software for Arm A-Profile architectures (Armv8-A and Armv7-A).
> 
> Cc: Alejandro Vazquez <avazquez.dev@gmail.com>
> Signed-off-by: Rouven Czerwinski <rouven@czerwinskis.de>
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> ---
> v2 -> v3:
>   - sorted version and md5 Kconfig options to top (mol)
>   - Added trailing spaces to align arrow after main prompt (mol)
>   - Changed TF_A_VERSION help text to indicate that the version can be any
>     git commitsh
>   - Removed default value for TF_A_ARTIFACTS (mol)
>   - integrated TF_A_VERSION into BUILD_STRING of resulting artifacts
>     (Guillermo, mtr)
>   - unconditional error if TF_A_ARTIFACTS is empty instead of warning later on
>     (mol)
>   - removed diplicate Prepare header (mol)
>   - resorted make variable definitions
>   - avoid unportable install --target-directory (Guillermo)
>   - documented support for globbing in TF_A_ARTIFACTS
>   - don't glob delete in IMAGEDIR, instead expand the glob in the build
>     directory first
> v1 -> v2:
>   - Made TF_A_ARCH_MAJOR configurable to support 32 bit ARMv8 (Guillermo)
>   - Replaces stm32mp-specific TF_A_DTB with TF_A_EXTRA_ARGS to contain
>     all board/vendor specific options
>   - removed reference to no longer existing CREDITS file
>   - removed TF_A_MAKE_OPT contents that are set elsewhere
>   - reduced uses of += in favor of directly appending to the string
>   - delete old build directory in prepare instead of compile
>   - use default compile stage (Guillermo)
>   - install artifacts to sysroot /usr/lib/firmware in install stage
>   - install artifacts to IMAGEDIR in targetinstall
>   - fix clean stage to delete proper artifacts
> ---
>  platforms/tf-a.in | 140 ++++++++++++++++++++++++++++++++++++++++++++++
>  rules/tf-a.make   | 118 ++++++++++++++++++++++++++++++++++++++
>  2 files changed, 258 insertions(+)
>  create mode 100644 platforms/tf-a.in
>  create mode 100644 rules/tf-a.make
> 
> diff --git a/platforms/tf-a.in b/platforms/tf-a.in
> new file mode 100644
> index 000000000000..75dad9d159f4
> --- /dev/null
> +++ b/platforms/tf-a.in
> @@ -0,0 +1,140 @@
[...]
> +config TF_A_VERSION
> +	string
> +	default "v2.2"
> +	prompt "TF-A version"
> +	help
> +	  Enter the TF-A git commitsh you want to build. Usally a tagged release
                                   ^                       ^
Some missing vowels here. Also, the git documentation uses spells it
"commit-ish" [1], but in most places it just says "commit".

[1] https://git-scm.com/docs/gitglossary

[...]
> diff --git a/rules/tf-a.make b/rules/tf-a.make
> new file mode 100644
> index 000000000000..bb7ba9e96822
> --- /dev/null
> +++ b/rules/tf-a.make
> @@ -0,0 +1,118 @@
[...]
> +#
> +# Paths and names
> +#
> +TF_A_VERSION	:= $(call remove_quotes,$(PTXCONF_TF_A_VERSION))
> +TF_A_MD5	:= $(call remove_quotes,$(PTXCONF_TF_A_MD5))
> +TF_A		:= tf-a-$(TF_A_VERSION)
> +TF_A_SUFFIX	:= tar.gz
> +TF_A_URL	:= https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/snapshot/$(TF_A_VERSION).$(TF_A_SUFFIX)
> +TF_A_SOURCE	:= $(SRCDIR)/$(TF_A).$(TF_A_SUFFIX)
> +TF_A_DIR	:= $(BUILDDIR)/$(TF_A)
> +TF_A_LICENSE    := BSD-3-Clause

What about the other licenses listed in docs/licenses.rst, such as NCSA,
and Zlib? Does any of this code make it into the TF-A binary?

> +
> +# ----------------------------------------------------------------------------
> +# Prepare
> +# ----------------------------------------------------------------------------
> +
> +TF_A_WRAPPER_BLACKLIST := \
> +	TARGET_HARDEN_RELRO \
> +	TARGET_HARDEN_BINDNOW \
> +	TARGET_HARDEN_PIE \
> +	TARGET_DEBUG \
> +	TARGET_BUILD_ID
> +
> +# TF_A_DEBUG=1

Is this a leftover? I see no other packages with a commented out
FOO_DEBUG=1 line.

regards
Philipp

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCH v3] tf-a: new package for ARM trusted firmware A

[Ahmad Fatoum]

Hello Philipp,

On 2/25/20 10:20 AM, Philipp Zabel wrote:
>> +	  Enter the TF-A git commitsh you want to build. Usally a tagged release
>                                    ^                       ^
> Some missing vowels here. Also, the git documentation uses spells it
> "commit-ish" [1], but in most places it just says "commit".

Will fix it. It is usually a tag, that's why I don't want it to say
"Enter the git commit".

> What about the other licenses listed in docs/licenses.rst, such as NCSA,
> and Zlib? Does any of this code make it into the TF-A binary?

hm. they are all compatible with BSD-3-Clause if only distributing:
BSD-3-Clause AND BSD-2-Clause AND NCSA AND Zlib

When patching some parts of the code, the patches need to be dually licensed,
thus:
BSD-3-Clause AND BSD-2-Clause AND NCSA AND Zlib AND MIT AND GPL-2.0

Is this ok?

>> +# TF_A_DEBUG=1
> 
> Is this a leftover? I see no other packages with a commented out
> FOO_DEBUG=1 line.

It affects both the DEBUG=X make parameter and the build output directory.
I didn't want to hardcode both places. Would inverted logic with TF_A_RELEASE := 1
be more acceptable?

Cheers
Ahmad


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCH v3] tf-a: new package for ARM trusted firmware A

[Michael Olbrich]

On Tue, Feb 25, 2020 at 10:20:52AM +0100, Philipp Zabel wrote:
> Hi,
> 
> On Wed, 2020-02-19 at 11:42 +0100, Ahmad Fatoum wrote:
> > Trusted Firmware-A (TF-A) is a reference implementation of secure world
> > software for Arm A-Profile architectures (Armv8-A and Armv7-A).
> > 
> > Cc: Alejandro Vazquez <avazquez.dev@gmail.com>
> > Signed-off-by: Rouven Czerwinski <rouven@czerwinskis.de>
> > Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> > ---
> > v2 -> v3:
> >   - sorted version and md5 Kconfig options to top (mol)
> >   - Added trailing spaces to align arrow after main prompt (mol)
> >   - Changed TF_A_VERSION help text to indicate that the version can be any
> >     git commitsh
> >   - Removed default value for TF_A_ARTIFACTS (mol)
> >   - integrated TF_A_VERSION into BUILD_STRING of resulting artifacts
> >     (Guillermo, mtr)
> >   - unconditional error if TF_A_ARTIFACTS is empty instead of warning later on
> >     (mol)
> >   - removed diplicate Prepare header (mol)
> >   - resorted make variable definitions
> >   - avoid unportable install --target-directory (Guillermo)
> >   - documented support for globbing in TF_A_ARTIFACTS
> >   - don't glob delete in IMAGEDIR, instead expand the glob in the build
> >     directory first
> > v1 -> v2:
> >   - Made TF_A_ARCH_MAJOR configurable to support 32 bit ARMv8 (Guillermo)
> >   - Replaces stm32mp-specific TF_A_DTB with TF_A_EXTRA_ARGS to contain
> >     all board/vendor specific options
> >   - removed reference to no longer existing CREDITS file
> >   - removed TF_A_MAKE_OPT contents that are set elsewhere
> >   - reduced uses of += in favor of directly appending to the string
> >   - delete old build directory in prepare instead of compile
> >   - use default compile stage (Guillermo)
> >   - install artifacts to sysroot /usr/lib/firmware in install stage
> >   - install artifacts to IMAGEDIR in targetinstall
> >   - fix clean stage to delete proper artifacts
> > ---
> >  platforms/tf-a.in | 140 ++++++++++++++++++++++++++++++++++++++++++++++
> >  rules/tf-a.make   | 118 ++++++++++++++++++++++++++++++++++++++
> >  2 files changed, 258 insertions(+)
> >  create mode 100644 platforms/tf-a.in
> >  create mode 100644 rules/tf-a.make
> > 
> > diff --git a/platforms/tf-a.in b/platforms/tf-a.in
> > new file mode 100644
> > index 000000000000..75dad9d159f4
> > --- /dev/null
> > +++ b/platforms/tf-a.in
> > @@ -0,0 +1,140 @@
> [...]
> > +config TF_A_VERSION
> > +	string
> > +	default "v2.2"
> > +	prompt "TF-A version"
> > +	help
> > +	  Enter the TF-A git commitsh you want to build. Usally a tagged release
>                                    ^                       ^
> Some missing vowels here. Also, the git documentation uses spells it
> "commit-ish" [1], but in most places it just says "commit".
> 
> [1] https://git-scm.com/docs/gitglossary

"commit-ish" is correct here. Because any commit-ish can be used here (e.g.
tags), not just commits.

> [...]
> > diff --git a/rules/tf-a.make b/rules/tf-a.make
> > new file mode 100644
> > index 000000000000..bb7ba9e96822
> > --- /dev/null
> > +++ b/rules/tf-a.make
> > @@ -0,0 +1,118 @@
> [...]
> > +#
> > +# Paths and names
> > +#
> > +TF_A_VERSION	:= $(call remove_quotes,$(PTXCONF_TF_A_VERSION))
> > +TF_A_MD5	:= $(call remove_quotes,$(PTXCONF_TF_A_MD5))
> > +TF_A		:= tf-a-$(TF_A_VERSION)
> > +TF_A_SUFFIX	:= tar.gz
> > +TF_A_URL	:= https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/snapshot/$(TF_A_VERSION).$(TF_A_SUFFIX)
> > +TF_A_SOURCE	:= $(SRCDIR)/$(TF_A).$(TF_A_SUFFIX)
> > +TF_A_DIR	:= $(BUILDDIR)/$(TF_A)
> > +TF_A_LICENSE    := BSD-3-Clause
> 
> What about the other licenses listed in docs/licenses.rst, such as NCSA,
> and Zlib? Does any of this code make it into the TF-A binary?
> 
> > +
> > +# ----------------------------------------------------------------------------
> > +# Prepare
> > +# ----------------------------------------------------------------------------
> > +
> > +TF_A_WRAPPER_BLACKLIST := \
> > +	TARGET_HARDEN_RELRO \
> > +	TARGET_HARDEN_BINDNOW \
> > +	TARGET_HARDEN_PIE \
> > +	TARGET_DEBUG \
> > +	TARGET_BUILD_ID
> > +
> > +# TF_A_DEBUG=1
> 
> Is this a leftover? I see no other packages with a commented out
> FOO_DEBUG=1 line.

I asked him to remove this in a previous version. So far he is resisting.
But I can do a fixup here if necessary :-).

Michael

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCH v3] tf-a: new package for ARM trusted firmware A

[Ahmad Fatoum]

On 2/25/20 10:44 AM, Michael Olbrich wrote:
> On Tue, Feb 25, 2020 at 10:20:52AM +0100, Philipp Zabel wrote:
>> Hi,
>>
>> On Wed, 2020-02-19 at 11:42 +0100, Ahmad Fatoum wrote:
>>> Trusted Firmware-A (TF-A) is a reference implementation of secure world
>>> software for Arm A-Profile architectures (Armv8-A and Armv7-A).
>>>
>>> Cc: Alejandro Vazquez <avazquez.dev@gmail.com>
>>> Signed-off-by: Rouven Czerwinski <rouven@czerwinskis.de>
>>> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
>>> ---
>>> v2 -> v3:
>>>   - sorted version and md5 Kconfig options to top (mol)
>>>   - Added trailing spaces to align arrow after main prompt (mol)
>>>   - Changed TF_A_VERSION help text to indicate that the version can be any
>>>     git commitsh
>>>   - Removed default value for TF_A_ARTIFACTS (mol)
>>>   - integrated TF_A_VERSION into BUILD_STRING of resulting artifacts
>>>     (Guillermo, mtr)
>>>   - unconditional error if TF_A_ARTIFACTS is empty instead of warning later on
>>>     (mol)
>>>   - removed diplicate Prepare header (mol)
>>>   - resorted make variable definitions
>>>   - avoid unportable install --target-directory (Guillermo)
>>>   - documented support for globbing in TF_A_ARTIFACTS
>>>   - don't glob delete in IMAGEDIR, instead expand the glob in the build
>>>     directory first
>>> v1 -> v2:
>>>   - Made TF_A_ARCH_MAJOR configurable to support 32 bit ARMv8 (Guillermo)
>>>   - Replaces stm32mp-specific TF_A_DTB with TF_A_EXTRA_ARGS to contain
>>>     all board/vendor specific options
>>>   - removed reference to no longer existing CREDITS file
>>>   - removed TF_A_MAKE_OPT contents that are set elsewhere
>>>   - reduced uses of += in favor of directly appending to the string
>>>   - delete old build directory in prepare instead of compile
>>>   - use default compile stage (Guillermo)
>>>   - install artifacts to sysroot /usr/lib/firmware in install stage
>>>   - install artifacts to IMAGEDIR in targetinstall
>>>   - fix clean stage to delete proper artifacts
>>> ---
>>>  platforms/tf-a.in | 140 ++++++++++++++++++++++++++++++++++++++++++++++
>>>  rules/tf-a.make   | 118 ++++++++++++++++++++++++++++++++++++++
>>>  2 files changed, 258 insertions(+)
>>>  create mode 100644 platforms/tf-a.in
>>>  create mode 100644 rules/tf-a.make
>>>
>>> diff --git a/platforms/tf-a.in b/platforms/tf-a.in
>>> new file mode 100644
>>> index 000000000000..75dad9d159f4
>>> --- /dev/null
>>> +++ b/platforms/tf-a.in
>>> @@ -0,0 +1,140 @@
>> [...]
>>> +config TF_A_VERSION
>>> +	string
>>> +	default "v2.2"
>>> +	prompt "TF-A version"
>>> +	help
>>> +	  Enter the TF-A git commitsh you want to build. Usally a tagged release
>>                                    ^                       ^
>> Some missing vowels here. Also, the git documentation uses spells it
>> "commit-ish" [1], but in most places it just says "commit".
>>
>> [1] https://git-scm.com/docs/gitglossary
> 
> "commit-ish" is correct here. Because any commit-ish can be used here (e.g.
> tags), not just commits.
> 
>> [...]
>>> diff --git a/rules/tf-a.make b/rules/tf-a.make
>>> new file mode 100644
>>> index 000000000000..bb7ba9e96822
>>> --- /dev/null
>>> +++ b/rules/tf-a.make
>>> @@ -0,0 +1,118 @@
>> [...]
>>> +#
>>> +# Paths and names
>>> +#
>>> +TF_A_VERSION	:= $(call remove_quotes,$(PTXCONF_TF_A_VERSION))
>>> +TF_A_MD5	:= $(call remove_quotes,$(PTXCONF_TF_A_MD5))
>>> +TF_A		:= tf-a-$(TF_A_VERSION)
>>> +TF_A_SUFFIX	:= tar.gz
>>> +TF_A_URL	:= https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/snapshot/$(TF_A_VERSION).$(TF_A_SUFFIX)
>>> +TF_A_SOURCE	:= $(SRCDIR)/$(TF_A).$(TF_A_SUFFIX)
>>> +TF_A_DIR	:= $(BUILDDIR)/$(TF_A)
>>> +TF_A_LICENSE    := BSD-3-Clause
>>
>> What about the other licenses listed in docs/licenses.rst, such as NCSA,
>> and Zlib? Does any of this code make it into the TF-A binary?
>>
>>> +
>>> +# ----------------------------------------------------------------------------
>>> +# Prepare
>>> +# ----------------------------------------------------------------------------
>>> +
>>> +TF_A_WRAPPER_BLACKLIST := \
>>> +	TARGET_HARDEN_RELRO \
>>> +	TARGET_HARDEN_BINDNOW \
>>> +	TARGET_HARDEN_PIE \
>>> +	TARGET_DEBUG \
>>> +	TARGET_BUILD_ID
>>> +
>>> +# TF_A_DEBUG=1
>>
>> Is this a leftover? I see no other packages with a commented out
>> FOO_DEBUG=1 line.
> 
> I asked him to remove this in a previous version. So far he is resisting.
> But I can do a fixup here if necessary :-).

Would TF_A_RELEASE := 1 be more palatable?

> 
> Michael
> 


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCH v3] tf-a: new package for ARM trusted firmware A

[Roland Hieber]

On Tue, Feb 25, 2020 at 10:44:18AM +0100, Ahmad Fatoum wrote:
> Hello Philipp,
> 
> On 2/25/20 10:20 AM, Philipp Zabel wrote:
> >> +	  Enter the TF-A git commitsh you want to build. Usally a tagged release
> >                                    ^                       ^
> > Some missing vowels here. Also, the git documentation uses spells it
> > "commit-ish" [1], but in most places it just says "commit".
> 
> Will fix it. It is usually a tag, that's why I don't want it to say
> "Enter the git commit".
> 
> > What about the other licenses listed in docs/licenses.rst, such as NCSA,
> > and Zlib? Does any of this code make it into the TF-A binary?
> 
> hm. they are all compatible with BSD-3-Clause if only distributing:
> BSD-3-Clause AND BSD-2-Clause AND NCSA AND Zlib
> 
> When patching some parts of the code, the patches need to be dually licensed,

I don't understand why this is the case, even if docs/license.rst says
so. If libfdt authors and STM allows us to choose between BSD or
GPL-2.0, we can choose to distribute our patches under any one of those.
(And if we choose BSD, which also TF-A did, we don't even need to
license our contributions as BSD since BSD has no copyleft). Sure, our
patches probably won't be accepted upstream by libfdt or STM under only
those licenses, but that's another problem.

In any way I think it's best to resolve this by keeping the original
disjunctive license statements:

BSD-3-Clause AND BSD-2-Clause           # main license and FreeBSD libc
AND (GPL-2.0-or-later OR BSD-2-Clause)  # libfdt
AND (NCSA OR MIT)                       # LLVM compiler-rt
AND Zlib                                # zlib
AND (GPL-2.0-or-later OR BSD-3-Clause)  # STM platform code

This way it is clear that we can choose between GPL and BSD for parts of
the code, even if the most reasonable outcome of the calculation of all
license terms is effectively BSD-3-Clause.

 - Roland

-- 
Roland Hieber, Pengutronix e.K.          | r.hieber@pengutronix.de     |
Steuerwalder Str. 21                     | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686         | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

Re: [ptxdist] [PATCH v3] tf-a: new package for ARM trusted firmware A

[Ahmad Fatoum]

Hi,

On 2/27/20 10:47 AM, Roland Hieber wrote:
> On Tue, Feb 25, 2020 at 10:44:18AM +0100, Ahmad Fatoum wrote:
>> When patching some parts of the code, the patches need to be dually licensed,
> 
> I don't understand why this is the case, even if docs/license.rst says
> so. If libfdt authors and STM allows us to choose between BSD or
> GPL-2.0, we can choose to distribute our patches under any one of those.
> (And if we choose BSD, which also TF-A did, we don't even need to
> license our contributions as BSD since BSD has no copyleft). Sure, our
> patches probably won't be accepted upstream by libfdt or STM under only
> those licenses, but that's another problem.

Makes sense. Thanks for the clarification.
 
> In any way I think it's best to resolve this by keeping the original
> disjunctive license statements:
> 
> BSD-3-Clause AND BSD-2-Clause           # main license and FreeBSD libc
> AND (GPL-2.0-or-later OR BSD-2-Clause)  # libfdt
> AND (NCSA OR MIT)                       # LLVM compiler-rt
> AND Zlib                                # zlib
> AND (GPL-2.0-or-later OR BSD-3-Clause)  # STM platform code> 
> This way it is clear that we can choose between GPL and BSD for parts of
> the code, even if the most reasonable outcome of the calculation of all
> license terms is effectively BSD-3-Clause.

Will do in v4.

Thanks for your input,
Ahmad

> 
>  - Roland
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de