[ptxdist] [PATCH v2 0/5] Support for OP-TEE (Open Portable Trusted Execution Environment)

[ptxdist] [PATCH v2 0/5] Support for OP-TEE (Open Portable Trusted Execution Environment)

[Rouven Czerwinski]

This series adds support for OP-TEE to ptxdist.
The series starts by bumping the client version and adding a systemd
service file for the tee-supplicant.
The core OP-TEE package is added next and the test and examples are also
introduced into ptxdist.

v2:
- Address review comments from Michael Olbrich
- Disable ARM64 by depending on BROKEN
- Move xtest to optee-xtest for optee-test package
- Install examples into /usr/lib/optee/examples

Regards,
Rouven Czerwinski

Rouven Czerwinski (5):
  optee-client: bump to 3.4.0
  optee-client: add tee-supplicant service file
  optee: add the OP-TEE as new target package
  optee-test: add new optee-test target package
  optee-examples: add as new target package

 platforms/optee.in                                        |  41 +++-
 projectroot/usr/lib/systemd/system/tee-supplicant.service |   9 +-
 rules/optee-client.in                                     |  13 +-
 rules/optee-client.make                                   |  12 +-
 rules/optee-examples.in                                   |  10 +-
 rules/optee-examples.make                                 |  75 +++++-
 rules/optee-test.in                                       |   9 +-
 rules/optee-test.make                                     |  71 +++++-
 rules/optee.in                                            |   4 +-
 rules/optee.make                                          |  99 +++++++-
 10 files changed, 340 insertions(+), 3 deletions(-)
 create mode 100644 platforms/optee.in
 create mode 100644 projectroot/usr/lib/systemd/system/tee-supplicant.service
 create mode 100644 rules/optee-examples.in
 create mode 100644 rules/optee-examples.make
 create mode 100644 rules/optee-test.in
 create mode 100644 rules/optee-test.make
 create mode 100644 rules/optee.in
 create mode 100644 rules/optee.make

base-commit: eebcc6a5054db3f9b3cd3617267061fdc51b4701
-- 
git-series 0.9.1

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

[ptxdist] [PATCH v2 1/5] optee-client: bump to 3.4.0

[Rouven Czerwinski]

Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
---
 rules/optee-client.make | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rules/optee-client.make b/rules/optee-client.make
index 8726f77..09cae7e 100644
--- a/rules/optee-client.make
+++ b/rules/optee-client.make
@@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_OPTEE_CLIENT) += optee-client
 #
 # Paths and names
 #
-OPTEE_CLIENT_VERSION	:= 2.4.0
-OPTEE_CLIENT_MD5	:= 5c27298b0e28aa9b28d18e44c79cc66d
+OPTEE_CLIENT_VERSION	:= 3.4.0
+OPTEE_CLIENT_MD5	:= ccefa79858454e9255d1a5f93335e322
 OPTEE_CLIENT		:= optee-client-$(OPTEE_CLIENT_VERSION)
 OPTEE_CLIENT_SUFFIX	:= tar.gz
 OPTEE_CLIENT_URL	:= https://github.com/OP-TEE/optee_client/archive/$(OPTEE_CLIENT_VERSION).$(OPTEE_CLIENT_SUFFIX)
-- 
git-series 0.9.1

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

[ptxdist] [PATCH v2 2/5] optee-client: add tee-supplicant service file

[Rouven Czerwinski]

Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
---
 projectroot/usr/lib/systemd/system/tee-supplicant.service |  9 ++++++-
 rules/optee-client.in                                     | 13 +++++++-
 rules/optee-client.make                                   |  8 +++++-
 3 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 projectroot/usr/lib/systemd/system/tee-supplicant.service

diff --git a/projectroot/usr/lib/systemd/system/tee-supplicant.service b/projectroot/usr/lib/systemd/system/tee-supplicant.service
new file mode 100644
index 0000000..f8eacff
--- /dev/null
+++ b/projectroot/usr/lib/systemd/system/tee-supplicant.service
@@ -0,0 +1,9 @@
+[Unit]
+Description=TEE Supplicant
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/tee-supplicant
+
+[Install]
+WantedBy=multi-user.target
\ No newline at end of file
diff --git a/rules/optee-client.in b/rules/optee-client.in
index 9099b4c..0ed2511 100644
--- a/rules/optee-client.in
+++ b/rules/optee-client.in
@@ -1,8 +1,9 @@
 ## SECTION=security
 
-config OPTEE_CLIENT
+menuconfig OPTEE_CLIENT
 	tristate
 	prompt "optee-client"
+	select OPTEE
 	help
 	  Open Portable Trusted Execution Environment Client API.
 
@@ -11,3 +12,13 @@ config OPTEE_CLIENT
 	  a binary tee-supplicant which is a daemon serving the
 	  Trusted OS in secure world with miscellaneous features, such
 	  as file system access.
+
+if OPTEE_CLIENT
+
+config OPTEE_CLIENT_SYSTEMD_UNIT
+	bool
+	default y
+	depends on SYSTEMD
+	prompt "install systemd service file for tee-supplicant"
+
+endif
diff --git a/rules/optee-client.make b/rules/optee-client.make
index 09cae7e..9c5d30b 100644
--- a/rules/optee-client.make
+++ b/rules/optee-client.make
@@ -54,6 +54,14 @@ $(STATEDIR)/optee-client.targetinstall:
 
 	@$(call install_lib, optee-client, 0, 0, 0644, libteec)
 	@$(call install_copy, optee-client, 0, 0, 0755, -, /usr/bin/tee-supplicant)
+ifdef PTXCONF_INITMETHOD_SYSTEMD
+ifdef PTXCONF_OPTEE_CLIENT_SYSTEMD_UNIT
+	@$(call install_alternative, optee-client, 0, 0, 0644, \
+		/usr/lib/systemd/system/tee-supplicant.service)
+	@$(call install_link, optee-client, ../tee-supplicant.service,\
+		/usr/lib/systemd/system/multi-user.target.wants/tee-supplicant.service)
+endif
+endif
 
 	@$(call install_finish, optee-client)
 
-- 
git-series 0.9.1

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

[ptxdist] [PATCH v2 3/5] optee: add the OP-TEE as new target package

[Rouven Czerwinski]

Provide two KConfig files to allow inclusion of OP-TEE for userspace libraries
and applications.

Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
---
 platforms/optee.in |  41 +++++++++++++++++++-
 rules/optee.in     |   4 ++-
 rules/optee.make   |  99 ++++++++++++++++++++++++++++++++++++++++++++++-
 3 files changed, 144 insertions(+)
 create mode 100644 platforms/optee.in
 create mode 100644 rules/optee.in
 create mode 100644 rules/optee.make

diff --git a/platforms/optee.in b/platforms/optee.in
new file mode 100644
index 0000000..d88e435
--- /dev/null
+++ b/platforms/optee.in
@@ -0,0 +1,41 @@
+## SECTION=bootloader
+
+menuconfig OPTEE
+	select BOOTLOADER
+	prompt "OPTEE"
+	bool
+	depends on ARCH_ARM || ARCH_ARM64
+	depends on !ARCH_ARM64 || BROKEN 
+	help
+	  OP-TEE is an open source project which contains a full implementation
+	  to make up a complete Trusted Execution Environment. The project has
+	  roots in a proprietary solution, initially created by ST-Ericsson and
+	  then owned and maintained by STMicroelectronics. In 2014, Linaro
+	  started working with STMicroelectronics to transform the proprietary
+	  TEE solution into an open source TEE solution instead.
+
+if OPTEE
+
+config OPTEE_PLATFORM
+	string
+	prompt "OPTEE Platform"
+	help
+	  Platform to use for OP-TEE.
+	  i.e. imx for the NXP imx platform or vexpress for versatile express
+	  platforms.
+
+config OPTEE_PLATFORM_FLAVOUR
+	string
+	prompt "OPTEE Platform Flavour"
+	help
+	  Platform Flavour for the selected platform, i.e. mx6qsabresd for the
+	  imx platform.
+
+config OPTEE_CFG
+	string
+	prompt "OP-TEE CFG Flags"
+	help
+	  Refer to the following file for the CFG_FLAGS:
+	  https://github.com/OP-TEE/optee_os/blob/master/mk/config.mk
+
+endif
diff --git a/rules/optee.in b/rules/optee.in
new file mode 100644
index 0000000..49bc6c9
--- /dev/null
+++ b/rules/optee.in
@@ -0,0 +1,4 @@
+## SECTION=security
+
+config OPTEE
+	   tristate
diff --git a/rules/optee.make b/rules/optee.make
new file mode 100644
index 0000000..e4dc9ab
--- /dev/null
+++ b/rules/optee.make
@@ -0,0 +1,99 @@
+# -*-makefile-*-
+#
+# Copyright (C) 2018 by Rouven Czerwinski <rouven@czerwinskis.de>
+#
+# See CREDITS for details about who has contributed to this project.
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+#
+# We provide this package
+#
+PACKAGES-$(PTXCONF_OPTEE) += optee
+
+#
+# Paths and names
+#
+OPTEE_VERSION	:= 3.4.0
+OPTEE_MD5	:= d0644c0f57124f183034e5fd7b26513e
+OPTEE		:= optee-$(OPTEE_VERSION)
+OPTEE_SUFFIX	:= tar.gz
+OPTEE_URL	:= https://github.com/OP-TEE/optee_os/archive/$(OPTEE_VERSION).$(OPTEE_SUFFIX)
+OPTEE_SOURCE	:= $(SRCDIR)/$(OPTEE).$(OPTEE_SUFFIX)
+OPTEE_DIR	:= $(BUILDDIR)/$(OPTEE)
+OPTEE_LICENSE	:= BSD-2-Clause AND BSD-3-Clause
+
+# ----------------------------------------------------------------------------
+# Prepare
+# ----------------------------------------------------------------------------
+
+OPTEE_WRAPPER_BLACKLIST := \
+	TARGET_HARDEN_RELRO \
+	TARGET_HARDEN_BINDNOW \
+	TARGET_HARDEN_PIE \
+	TARGET_DEBUG \
+	TARGET_BUILD_ID
+
+OPTEE_CONF_TOOL := NO
+
+# ----------------------------------------------------------------------------
+# Compile
+# ----------------------------------------------------------------------------
+
+OPTEE_MAKE_OPT += $(call ptx/ifdef,PTXCONF_ARCH_ARM64,CFG_ARM64_core=y)
+
+OPTEE_MAKE_OPT += PLATFORM=$(call remove_quotes,$(PTXCONF_OPTEE_PLATFORM))-$(call remove_quotes,$(PTXCONF_OPTEE_PLATFORM_FLAVOUR))
+OPTEE_MAKE_OPT += $(call remove_quotes,$(PTXCONF_OPTEE_CFG))
+
+# ----------------------------------------------------------------------------
+# Install
+# ----------------------------------------------------------------------------
+
+OPTEE_LIB_DIR := \
+	$(call ptx/ifdef,PTXCONF_ARCH_ARM64,export-ta_arm64,export-ta_arm32)
+
+OPTEE_OUT_DIR        := \
+	$(OPTEE_DIR)/out/arm-plat-$(PTXCONF_OPTEE_PLATFORM)
+
+$(STATEDIR)/optee.install:
+	@$(call targetinfo)
+
+	@$(call install_init, optee)
+	@install -d -m755 $(OPTEE_PKGDIR)/usr/lib/optee-os
+	@cp -r $(OPTEE_OUT_DIR)/$(OPTEE_LIB_DIR)/* $(OPTEE_PKGDIR)/usr/lib/optee-os
+
+	@$(call touch)
+
+# ----------------------------------------------------------------------------
+# Target-Install
+# ----------------------------------------------------------------------------
+
+OPTEE_BINARIES := \
+	tee.bin \
+	tee-header_v2.bin \
+	tee-pager_v2.bin \
+	tee-pageable_v2.bin \
+	tee.elf
+
+$(STATEDIR)/optee.targetinstall:
+	@$(call targetinfo)
+
+	@$(call install_init, optee)
+	@$(foreach binary, $(OPTEE_BINARIES), \
+		install -D -m644 $(OPTEE_OUT_DIR)/core/$(binary) $(IMAGEDIR)/$(binary);)
+
+	@$(call touch)
+
+# ----------------------------------------------------------------------------
+# Clean
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/optee.clean:
+	@$(call targetinfo)
+	@$(foreach binary, $(OPTEE_BINARIES), \
+		rm -f $(IMAGEDIR)/$(binary);)
+	@$(call clean_pkg, OPTEE)
+
+# vim: syntax=make
-- 
git-series 0.9.1

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

[ptxdist] [PATCH v2 4/5] optee-test: add new optee-test target package

[Rouven Czerwinski]

Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
---
 rules/optee-test.in   |  9 ++++++-
 rules/optee-test.make | 71 ++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 80 insertions(+)
 create mode 100644 rules/optee-test.in
 create mode 100644 rules/optee-test.make

diff --git a/rules/optee-test.in b/rules/optee-test.in
new file mode 100644
index 0000000..743a080
--- /dev/null
+++ b/rules/optee-test.in
@@ -0,0 +1,9 @@
+## SECTION=security
+
+config OPTEE_TEST
+	tristate
+	select OPTEE_CLIENT
+	select OPENSSL
+	prompt "OP-TEE Test"
+	help
+	  FIXME
diff --git a/rules/optee-test.make b/rules/optee-test.make
new file mode 100644
index 0000000..3bbde74
--- /dev/null
+++ b/rules/optee-test.make
@@ -0,0 +1,71 @@
+# -*-makefile-*-
+#
+# Copyright (C) 2018 by Rouven Czerwinski <rouven@czerwinskis.de>
+#
+# See CREDITS for details about who has contributed to this project.
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+#
+# We provide this package
+#
+PACKAGES-$(PTXCONF_OPTEE_TEST) += optee-test
+
+#
+# Paths and names
+#
+OPTEE_TEST_VERSION	:= 3.4.0
+OPTEE_TEST_MD5		:= 5bfd9c01a8271e0b7d623d208349f183
+OPTEE_TEST		:= optee-test-$(OPTEE_TEST_VERSION)
+OPTEE_TEST_SUFFIX	:= tar.gz
+OPTEE_TEST_URL		:= https://github.com/OP-TEE/optee_test/archive/$(OPTEE_TEST_VERSION).$(OPTEE_TEST_SUFFIX)
+OPTEE_TEST_SOURCE	:= $(SRCDIR)/$(OPTEE_TEST).$(OPTEE_TEST_SUFFIX)
+OPTEE_TEST_DIR		:= $(BUILDDIR)/$(OPTEE_TEST)
+OPTEE_TEST_LICENSE	:= BSD-2-Clause and GPL-2.0
+
+# ----------------------------------------------------------------------------
+# Prepare
+# ----------------------------------------------------------------------------
+
+OPTEE_TEST_CONF_TOOL	:= NO
+OPTEE_TEST_CONF_ENV	:= $(CROSS_ENV)
+OPTEE_TEST_MAKE_ENV	+= CROSS_COMPILE_HOST=$(call remove_quotes,$(PTXCONF_COMPILER_PREFIX))
+OPTEE_TEST_MAKE_ENV	+= CROSS_COMPILE_TA=$(call remove_quotes,$(PTXCONF_COMPILER_PREFIX))
+OPTEE_TEST_MAKE_ENV	+= TA_DEV_KIT_DIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib/optee-os
+OPTEE_TEST_MAKE_ENV	+= OPTEE_CLIENT_EXPORT=$(PTXDIST_SYSROOT_TARGET)/usr
+OPTEE_TEST_MAKE_ENV	+= COMPILE_NS_USER=32 OPTEE_OPENSSL_EXPORT=$(PTXDIST_SYSROOT_TARGET)/usr/lib
+
+# ----------------------------------------------------------------------------
+# Install
+# ----------------------------------------------------------------------------
+
+OPTEE_TEST_INSTALL_OPT := install DESTDIR=$(OPTEE_TEST_PKGDIR)/usr/
+
+$(STATEDIR)/optee-test.install:
+	@$(call targetinfo)
+	@$(call world/install, OPTEE_TEST)
+	@mv $(OPTEE_TEST_PKGDIR)/usr/bin/xtest $(OPTEE_TEST_PKGDIR)/usr/bin/optee-xtest
+	@$(call touch)
+
+# ----------------------------------------------------------------------------
+# Target-Install
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/optee-test.targetinstall:
+	@$(call targetinfo)
+
+	@$(call install_init, optee-test)
+	@$(call install_fixup, optee-test,PRIORITY,optional)
+	@$(call install_fixup, optee-test,SECTION,base)
+	@$(call install_fixup, optee-test,AUTHOR,"Rouven Czerwinski <rouven@czerwinskis.de>")
+	@$(call install_fixup, optee-test,DESCRIPTION,missing)
+
+	@$(call install_copy, optee-test, 0, 0, 0755, -, /usr/bin/optee-xtest)
+	@$(call install_tree, optee-test, 0, 0, -, /usr/lib/optee_armtz)
+
+	@$(call install_finish, optee-test)
+
+	@$(call touch)
+# vim: syntax=make
-- 
git-series 0.9.1

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de

[ptxdist] [PATCH v2 5/5] optee-examples: add as new target package

[Rouven Czerwinski]

Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
---
 rules/optee-examples.in   | 10 +++++-
 rules/optee-examples.make | 75 ++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 85 insertions(+)
 create mode 100644 rules/optee-examples.in
 create mode 100644 rules/optee-examples.make

diff --git a/rules/optee-examples.in b/rules/optee-examples.in
new file mode 100644
index 0000000..304048f
--- /dev/null
+++ b/rules/optee-examples.in
@@ -0,0 +1,10 @@
+## SECTION=security
+
+config OPTEE_EXAMPLES
+	tristate
+	select OPTEE
+	select OPTEE_CLIENT
+	prompt "optee_examples"
+	help
+	  Install the optee examples package from
+	  https://github.com/linaro-swg/optee_examples
diff --git a/rules/optee-examples.make b/rules/optee-examples.make
new file mode 100644
index 0000000..4bf8629
--- /dev/null
+++ b/rules/optee-examples.make
@@ -0,0 +1,75 @@
+# -*-makefile-*-
+#
+# Copyright (C) 2018 by Rouven Czerwinski <rouven@czerwinskis.de>
+#
+# See CREDITS for details about who has contributed to this project.
+#
+# For further information about the PTXdist project and license conditions
+# see the README file.
+#
+
+#
+# We provide this package
+#
+PACKAGES-$(PTXCONF_OPTEE_EXAMPLES) += optee-examples
+
+#
+# Paths and names
+#
+OPTEE_EXAMPLES_VERSION	:= 3.4.0
+OPTEE_EXAMPLES_MD5	:= 20bf84c5c647f9270e9edb9bb79f75db
+OPTEE_EXAMPLES		:= optee-examples-$(OPTEE_EXAMPLES_VERSION)
+OPTEE_EXAMPLES_SUFFIX	:= tar.gz
+OPTEE_EXAMPLES_URL	:= https://github.com/linaro-swg/optee_examples/archive/$(OPTEE_EXAMPLES_VERSION).$(OPTEE_EXAMPLES_SUFFIX)
+OPTEE_EXAMPLES_SOURCE	:= $(SRCDIR)/$(OPTEE_EXAMPLES).$(OPTEE_EXAMPLES_SUFFIX)
+OPTEE_EXAMPLES_DIR	:= $(BUILDDIR)/$(OPTEE_EXAMPLES)
+OPTEE_EXAMPLES_LICENSE	:= BSD-2-Clause
+
+# ----------------------------------------------------------------------------
+# Prepare
+# ----------------------------------------------------------------------------
+
+OPTEE_EXAMPLES_MAKE_ENV	:= \
+		$(CROSS_ENV)
+
+OPTEE_EXAMPLES_CONF_TOOL := NO
+
+OPTEE_EXAMPLES_MAKE_ENV += HOST_CROSS_COMPILE=$(call remove_quotes,$(PTXCONF_COMPILER_PREFIX))
+OPTEE_EXAMPLES_MAKE_ENV += TA_DEV_KIT_DIR=$(PTXDIST_SYSROOT_TARGET)/usr/lib/optee-os
+OPTEE_EXAMPLES_MAKE_ENV += TEEC_EXPORT=$(PTXDIST_SYSROOT_TARGET)/usr
+
+# ----------------------------------------------------------------------------
+# Install
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/optee-examples.install:
+	@$(call targetinfo)
+
+	@install -d -m755 $(OPTEE_EXAMPLES_PKGDIR)/usr/lib/optee_armtz
+	@install -d -m755 $(OPTEE_EXAMPLES_PKGDIR)/usr/lib/optee/examples
+	@cp -r $(OPTEE_EXAMPLES_DIR)/out/ta/* $(OPTEE_EXAMPLES_PKGDIR)/usr/lib/optee_armtz
+	@cp -r $(OPTEE_EXAMPLES_DIR)/out/ca/* $(OPTEE_EXAMPLES_PKGDIR)/usr/lib/optee/examples/
+
+	@$(call touch)
+
+# ----------------------------------------------------------------------------
+# Target-Install
+# ----------------------------------------------------------------------------
+
+$(STATEDIR)/optee-examples.targetinstall:
+	@$(call targetinfo)
+
+	@$(call install_init, optee-examples)
+	@$(call install_fixup, optee-examples,PRIORITY,optional)
+	@$(call install_fixup, optee-examples,SECTION,base)
+	@$(call install_fixup, optee-examples,AUTHOR,"Rouven Czerwinski <rouven@czerwinskis.de>")
+	@$(call install_fixup, optee-examples,DESCRIPTION,missing)
+
+	@$(call install_tree, optee-examples, 0, 0, -, /usr/lib/optee_armtz)
+	@$(call install_tree, optee-examples, 0, 0, -, /usr/lib/optee/examples/)
+
+	@$(call install_finish, optee-examples)
+
+	@$(call touch)
+
+# vim: syntax=make
-- 
git-series 0.9.1

_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de