arm-bsp: Enable SPM build option in yocto framework

This patch adds:
spm, tf-a-tests recipes.
This builds tf-a with SPM at S-EL2 and test secure partitions at S-EL1.

Change-Id: Ia2f44f4000aa0786b945bc8fb66c9edb1a0094e8
Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
Signed-off-by: Usama Arif <usama.arif@arm.com>

meta-arm-bsp/recipes-bsp/spm/spm_%.bbappend

@@ -0,0 +1,12 @@
+# TF-A spm
+
+SRCREV_FORMAT = "spm"
+
+SRCREV_spm = "764fd2eb2ece8b5bddc802cc8369743a283cd7d7"
+
+LIC_FILES_CHKSUM = "file://LICENSE;md5=782b40c14bad5294672c500501edc103"
+
+COMPATIBLE_MACHINE = "tc0"
+
+SPM_PLATFORM = "secure_tc0_clang"
+SPM_INSTALL_TARGET = "hafnium.bin"

meta-arm-bsp/recipes-bsp/tf-a-tests/tf-a-tests_%.bbappend

@@ -0,0 +1,13 @@
+# tf-a-tests
+
+SRCREV_FORMAT = "tfa-tests"
+
+SRCREV_tfa-tests = "b3bcf77a65880049e40fa6f1b764a19dbd9faead"
+
+LIC_FILES_CHKSUM = "file://docs/license.rst;md5=6175cc0aa2e63b6d21a32aa0ee7d1b4a"
+
+COMPATIBLE_MACHINE = "tc0"
+TFA_TESTS_PLATFORM = "tc0"
+TFA_TESTS_BUILD_TARGET = "all"
+TFA_TESTS_INSTALL_TARGET = "tftf.bin cactus.bin sp_layout.json \
+			    cactus.dts cactus-secondary.dts cactus-tertiary.dts"

meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-tc0.inc

@@ -1,9 +1,16 @@
 # TCO specific TFA configuration
 
 # Intermediate SHA with 2.3 baseline version
-SRCREV_tfa = "16796a25fefc4ecf780211bf554d3b8dc5436fa4"
+SRCREV_tfa = "00ad74c7afe67b2ffaf08300710f18d3dafebb45"
 
 DEPENDS += "scp-firmware"
+DEPENDS += "spm"
+
+# Currenly only test partition images are available to be executed at S-EL1.
+SP_AT_SEL1 = "cactus"
+
+# Enable test secure partitions if SP_AT_SEL1 is cactus
+DEPENDS += " tf-a-tests "
 
 COMPATIBLE_MACHINE = "tc0"
 
@@ -12,8 +19,15 @@ TFA_BUILD_TARGET = "all fip"
 TFA_UBOOT = "1"
 TFA_INSTALL_TARGET = "bl1 fip"
 TFA_MBEDTLS = "1"
-TFA_DEBUG = "1"
 
 EXTRA_OEMAKE += "SCP_BL2=${RECIPE_SYSROOT}/firmware/scp_ramfw.bin"
 EXTRA_OEMAKE += "TRUSTED_BOARD_BOOT=1 GENERATE_COT=1 ARM_ROTPK_LOCATION=devel_rsa \
                      ROT_KEY=plat/arm/board/common/rotpk/arm_rotprivk_rsa.pem"
+
+
+do_compile[depends] += " spm:do_deploy "
+EXTRA_OEMAKE += " SPD=spmd CTX_INCLUDE_EL2_REGS=1 ARM_ARCH_MINOR=4 BL32=${DEPLOY_DIR_IMAGE}/hafnium.bin"
+
+# Enable test secure partitions if SP_AT_SEL1 is cactus
+do_compile[depends] += " tf-a-tests:do_deploy "
+EXTRA_OEMAKE += " SP_LAYOUT_FILE=${DEPLOY_DIR_IMAGE}/sp_layout.json "

meta-arm/recipes-bsp/spm/spm.inc

@@ -0,0 +1,85 @@
+DESCRIPTION = "TF-A spm"
+LICENSE = "BSD & Apache-2.0"
+
+PROVIDES = "virtual/spm"
+
+PACKAGE_ARCH = "${MACHINE_ARCH}"
+
+inherit deploy
+
+COMPATIBLE_MACHINE ?= "invalid"
+
+inherit pythonnative
+
+# Platform must be set for each machine
+SPM_PLATFORM ?= "invalid"
+
+# Build for debug (set SPM_DEBUG to 1 to activate)
+SPM_DEBUG ?= "0"
+
+# hafnium project
+SPM_PROJECT ?= "reference"
+
+# This is fixed for SPM
+SPM_BUILD_DIR ?= "out/${SPM_PROJECT}"
+
+# platform build directory
+SPM_BUILD_DIR_PLAT ?= "${SPM_BUILD_DIR}/${SPM_PLATFORM}"
+
+# set project to build
+EXTRA_OEMAKE += "PROJECT=${SPM_PROJECT}"
+
+SPM_BUILD_TARGET ?= "hafnium.bin"
+
+# do_deploy will install everything listed in this
+# variable. It is set by default to SPM_BUILD_TARGET
+SPM_INSTALL_TARGET ?= "${SPM_BUILD_TARGET}"
+
+# Requires CROSS_COMPILE set by hand as there is no configure script
+
+# Currently SPM uses complier from prebuilts submodule. CROSS_COMPILE will
+# be set once prebuilts dependencies are removed.
+#export CROSS_COMPILE="${TARGET_PREFIX}"
+
+# Let the Makefile handle setting up the CFLAGS and LDFLAGS
+# as it is a standalone application
+CFLAGS[unexport] = "1"
+LDFLAGS[unexport] = "1"
+AS[unexport] = "1"
+LD[unexport] = "1"
+
+# No configure or install
+do_configure[noexec] = "1"
+do_install[noexec] = "1"
+
+# needs bison, bc
+DEPENDS_append = " bison-native bc-native"
+
+
+# Handle SPM_DEBUG parameter
+EXTRA_OEMAKE += "${@bb.utils.contains('SPM_DEBUG', '1', ' DEBUG=${SPM_DEBUG}', '', d)}"
+
+do_compile() {
+    oe_runmake
+}
+
+do_deploy() {
+    install -d -m 755 ${DEPLOYDIR}
+    for bldfile in ${SPM_INSTALL_TARGET}; do
+        if [ "$bldfile" = "all" ]; then
+            # Target all is not handled by default
+            bberror "all as SPM_INSTALL_TARGET is not handled"
+            bberror "Please specify valid targets in SPM_INSTALL_TARGET"
+            bberror "or rewrite or turn off do_deploy"
+            exit 1
+        elif [ -f ${S}/${SPM_BUILD_DIR_PLAT}/$bldfile ]; then
+            echo "Install $bldfile"
+            install -m 0755 ${S}/${SPM_BUILD_DIR_PLAT}/$bldfile \
+                ${DEPLOYDIR}/$bldfile
+        else
+            bberror "Unsupported SPM_INSTALL_TARGET target $bldfile"
+            exit 1
+        fi
+    done
+}
+addtask deploy before do_build after do_compile

meta-arm/recipes-bsp/spm/spm_git.bb

@@ -0,0 +1,12 @@
+# TF-A spm
+#
+
+# Never select this if another version is available
+DEFAULT_PREFERENCE = "-1"
+
+require spm.inc
+
+SRC_URI = "gitsm://git.trustedfirmware.org/hafnium/hafnium.git;;protocol=https;name=spm"
+SRCREV_FORMAT = "spm"
+
+S = "${WORKDIR}/git"

meta-arm/recipes-bsp/tf-a-tests/tf-a-tests.inc

@@ -0,0 +1,87 @@
+DESCRIPTION = "Trusted Firmware-A Tests"
+LICENSE = "BSD & Apache-2.0"
+
+PROVIDES = "virtual/tf-a-tests"
+
+PACKAGE_ARCH = "${MACHINE_ARCH}"
+
+inherit deploy
+
+COMPATIBLE_MACHINE ?= "invalid"
+
+# Platform must be set for each machine
+TFA_TESTS_PLATFORM ?= "invalid"
+
+# Build for debug (set TFA_TESTS_DEBUG to 1 to activate)
+TFA_TESTS_DEBUG ?= "0"
+
+# Sub-directory in which to build.
+# This must be coherent with BUILD_PLAT make parameter so that deploy can find
+# the produced binaries
+#TFA_TESTS_BUILD_DIR ?= "build-${TFA_TESTS_PLATFORM}"
+TFA_TESTS_BUILD_DIR ?= "build/${TFA_TESTS_PLATFORM}/debug"
+
+# set BUILD_PLAT depending on configured BUILD_DIR
+EXTRA_OEMAKE += "BUILD_PLAT=${TFA_TESTS_BUILD_DIR}"
+
+# What to build
+TFA_TESTS_BUILD_TARGET ?= "tftf"
+
+# What to install
+# do_deploy will install everything listed in this
+# variable. It is set by default to TFA_TESTS_BUILD_TARGET
+TFA_TESTS_INSTALL_TARGET ?= "${TFA_TESTS_BUILD_TARGET}"
+
+# Requires CROSS_COMPILE set by hand as there is no configure script
+export CROSS_COMPILE="${TARGET_PREFIX}"
+
+# Let the Makefile handle setting up the CFLAGS and LDFLAGS as it is a standalone application
+CFLAGS[unexport] = "1"
+LDFLAGS[unexport] = "1"
+AS[unexport] = "1"
+LD[unexport] = "1"
+
+# No configure or install
+do_configure[noexec] = "1"
+do_install[noexec] = "1"
+
+# We need dtc for dtbs compilation
+# We need openssl for fiptool
+DEPENDS_append = " dtc-native openssl-native"
+
+# Add platform parameter
+EXTRA_OEMAKE += "PLAT=${TFA_TESTS_PLATFORM}"
+
+# Handle TFA_TESTS_DEBUG parameter
+EXTRA_OEMAKE += "${@bb.utils.contains('TFA_TESTS_DEBUG', '1', ' DEBUG=${TFA_TESTS_DEBUG}', '', d)}"
+
+do_clean() {
+    if [ -f ${S}/Makefile ]; then
+        oe_runmake -C ${S} distclean
+    fi
+}
+
+do_compile() {
+    oe_runmake ${TFA_TESTS_BUILD_TARGET}
+}
+
+do_deploy() {
+    install -d -m 755 ${DEPLOYDIR}
+    for bldfile in ${TFA_TESTS_INSTALL_TARGET}; do
+        if [ "$bldfile" = "all" ]; then
+            # Target all is not handled by default
+            bberror "all as TFA_TESTS_INSTALL_TARGET is not handled"
+            bberror "Please specify valid targets in TFA_TESTS_INSTALL_TARGET"
+            bberror "or rewrite or turn off do_deploy"
+            exit 1
+        elif [ -f ${S}/${TFA_TESTS_BUILD_DIR}/$bldfile ]; then
+            echo "Install $bldfile"
+            install -m 0644 ${S}/${TFA_TESTS_BUILD_DIR}/$bldfile \
+                ${DEPLOYDIR}/$bldfile
+        else
+            bberror "Unsupported TFA_TESTS_INSTALL_TARGET target $bldfile"
+            exit 1
+        fi
+    done
+}
+addtask deploy before do_build after do_compile

meta-arm/recipes-bsp/tf-a-tests/tf-a-tests_git.bb

@@ -0,0 +1,27 @@
+# tf-a-tests
+#
+
+# Never select this if another version is available
+DEFAULT_PREFERENCE = "-1"
+
+require tf-a-tests.inc
+
+SRC_URI = "git://git.trustedfirmware.org/TF-A/tf-a-tests.git;;protocol=https;name=tfa-tests"
+SRCREV_FORMAT = "tfa-tests"
+
+S = "${WORKDIR}/git"
+
+# The following hack is needed to fit properly in yocto build environment
+# TFA is forcing the host compiler and its flags in the Makefile using :=
+# assignment for GCC and CFLAGS.
+# To properly use the native toolchain of yocto and the right libraries we need
+# to pass the proper flags to gcc. This is achieved here by creating a gcc
+# script to force passing to gcc the right CFLAGS and LDFLAGS
+do_compile_prepend() {
+    # Create an host gcc build parser to ensure the proper include path is used
+    mkdir -p bin
+    echo "#!/usr/bin/env bash" > bin/gcc
+    echo "$(which ${BUILD_CC}) ${BUILD_CFLAGS} ${BUILD_LDFLAGS} \$@" >> bin/gcc
+    chmod a+x bin/gcc
+    export PATH="$PWD/bin:$PATH"
+}

meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.3.bb

@@ -21,10 +21,10 @@ LIC_FILES_CHKSUM = "file://docs/license.rst;md5=189505435dbcdcc8caa63c46fe93fa89
 # Those are used in trusted-firmware-a.inc if TFA_MBEDTLS is set to 1
 #
 
-SRC_URI_MBEDTLS = "git://github.com/ARMmbed/mbedtls.git;name=mbedtls;protocol=https;destsuffix=git/mbedtls;branch=mbedtls-2.18"
+SRC_URI_MBEDTLS = "git://github.com/ARMmbed/mbedtls.git;name=mbedtls;protocol=https;destsuffix=git/mbedtls;tag=v2.24.0"
 
 # mbed TLS v2.18.1
-SRCREV_mbedtls = "ca933c7e0c9e84738b168b6b0feb89af4183a60a"
+SRCREV_mbedtls = "v2.24.0"
 
 LIC_FILES_CHKSUM_MBEDTLS += " \
     file://mbedtls/apache-2.0.txt;md5=3b83ef96387f14655fc854ddc3c6bd57 \