From 86f9419b9d91ec972804bc9c39760e693255cb11 Mon Sep 17 00:00:00 2001 From: Arunachalam Ganapathy Date: Thu, 14 May 2020 12:15:29 +0100 Subject: [PATCH] arm-bsp: Enable SPM build option in yocto framework This patch adds: spm, tf-a-tests recipes. This builds tf-a with SPM at S-EL2 and test secure partitions at S-EL1. Change-Id: Ia2f44f4000aa0786b945bc8fb66c9edb1a0094e8 Signed-off-by: Arunachalam Ganapathy Signed-off-by: Usama Arif --- meta-arm-bsp/recipes-bsp/spm/spm_%.bbappend | 12 +++ .../tf-a-tests/tf-a-tests_%.bbappend | 13 +++ .../trusted-firmware-a-tc0.inc | 18 +++- meta-arm/recipes-bsp/spm/spm.inc | 85 ++++++++++++++++++ meta-arm/recipes-bsp/spm/spm_git.bb | 12 +++ .../recipes-bsp/tf-a-tests/tf-a-tests.inc | 87 +++++++++++++++++++ .../recipes-bsp/tf-a-tests/tf-a-tests_git.bb | 27 ++++++ .../trusted-firmware-a_2.3.bb | 4 +- 8 files changed, 254 insertions(+), 4 deletions(-) create mode 100644 meta-arm-bsp/recipes-bsp/spm/spm_%.bbappend create mode 100644 meta-arm-bsp/recipes-bsp/tf-a-tests/tf-a-tests_%.bbappend create mode 100644 meta-arm/recipes-bsp/spm/spm.inc create mode 100644 meta-arm/recipes-bsp/spm/spm_git.bb create mode 100644 meta-arm/recipes-bsp/tf-a-tests/tf-a-tests.inc create mode 100644 meta-arm/recipes-bsp/tf-a-tests/tf-a-tests_git.bb diff --git a/meta-arm-bsp/recipes-bsp/spm/spm_%.bbappend b/meta-arm-bsp/recipes-bsp/spm/spm_%.bbappend new file mode 100644 index 00000000..1c245c1e --- /dev/null +++ b/meta-arm-bsp/recipes-bsp/spm/spm_%.bbappend @@ -0,0 +1,12 @@ +# TF-A spm + +SRCREV_FORMAT = "spm" + +SRCREV_spm = "764fd2eb2ece8b5bddc802cc8369743a283cd7d7" + +LIC_FILES_CHKSUM = "file://LICENSE;md5=782b40c14bad5294672c500501edc103" + +COMPATIBLE_MACHINE = "tc0" + +SPM_PLATFORM = "secure_tc0_clang" +SPM_INSTALL_TARGET = "hafnium.bin" diff --git a/meta-arm-bsp/recipes-bsp/tf-a-tests/tf-a-tests_%.bbappend b/meta-arm-bsp/recipes-bsp/tf-a-tests/tf-a-tests_%.bbappend new file mode 100644 index 00000000..fefde6e6 --- /dev/null +++ b/meta-arm-bsp/recipes-bsp/tf-a-tests/tf-a-tests_%.bbappend @@ -0,0 +1,13 @@ +# tf-a-tests + +SRCREV_FORMAT = "tfa-tests" + +SRCREV_tfa-tests = "b3bcf77a65880049e40fa6f1b764a19dbd9faead" + +LIC_FILES_CHKSUM = "file://docs/license.rst;md5=6175cc0aa2e63b6d21a32aa0ee7d1b4a" + +COMPATIBLE_MACHINE = "tc0" +TFA_TESTS_PLATFORM = "tc0" +TFA_TESTS_BUILD_TARGET = "all" +TFA_TESTS_INSTALL_TARGET = "tftf.bin cactus.bin sp_layout.json \ + cactus.dts cactus-secondary.dts cactus-tertiary.dts" diff --git a/meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-tc0.inc b/meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-tc0.inc index 9af04e8a..eb72e575 100644 --- a/meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-tc0.inc +++ b/meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-tc0.inc @@ -1,9 +1,16 @@ # TCO specific TFA configuration # Intermediate SHA with 2.3 baseline version -SRCREV_tfa = "16796a25fefc4ecf780211bf554d3b8dc5436fa4" +SRCREV_tfa = "00ad74c7afe67b2ffaf08300710f18d3dafebb45" DEPENDS += "scp-firmware" +DEPENDS += "spm" + +# Currenly only test partition images are available to be executed at S-EL1. +SP_AT_SEL1 = "cactus" + +# Enable test secure partitions if SP_AT_SEL1 is cactus +DEPENDS += " tf-a-tests " COMPATIBLE_MACHINE = "tc0" @@ -12,8 +19,15 @@ TFA_BUILD_TARGET = "all fip" TFA_UBOOT = "1" TFA_INSTALL_TARGET = "bl1 fip" TFA_MBEDTLS = "1" -TFA_DEBUG = "1" EXTRA_OEMAKE += "SCP_BL2=${RECIPE_SYSROOT}/firmware/scp_ramfw.bin" EXTRA_OEMAKE += "TRUSTED_BOARD_BOOT=1 GENERATE_COT=1 ARM_ROTPK_LOCATION=devel_rsa \ ROT_KEY=plat/arm/board/common/rotpk/arm_rotprivk_rsa.pem" + + +do_compile[depends] += " spm:do_deploy " +EXTRA_OEMAKE += " SPD=spmd CTX_INCLUDE_EL2_REGS=1 ARM_ARCH_MINOR=4 BL32=${DEPLOY_DIR_IMAGE}/hafnium.bin" + +# Enable test secure partitions if SP_AT_SEL1 is cactus +do_compile[depends] += " tf-a-tests:do_deploy " +EXTRA_OEMAKE += " SP_LAYOUT_FILE=${DEPLOY_DIR_IMAGE}/sp_layout.json " diff --git a/meta-arm/recipes-bsp/spm/spm.inc b/meta-arm/recipes-bsp/spm/spm.inc new file mode 100644 index 00000000..2e920560 --- /dev/null +++ b/meta-arm/recipes-bsp/spm/spm.inc @@ -0,0 +1,85 @@ +DESCRIPTION = "TF-A spm" +LICENSE = "BSD & Apache-2.0" + +PROVIDES = "virtual/spm" + +PACKAGE_ARCH = "${MACHINE_ARCH}" + +inherit deploy + +COMPATIBLE_MACHINE ?= "invalid" + +inherit pythonnative + +# Platform must be set for each machine +SPM_PLATFORM ?= "invalid" + +# Build for debug (set SPM_DEBUG to 1 to activate) +SPM_DEBUG ?= "0" + +# hafnium project +SPM_PROJECT ?= "reference" + +# This is fixed for SPM +SPM_BUILD_DIR ?= "out/${SPM_PROJECT}" + +# platform build directory +SPM_BUILD_DIR_PLAT ?= "${SPM_BUILD_DIR}/${SPM_PLATFORM}" + +# set project to build +EXTRA_OEMAKE += "PROJECT=${SPM_PROJECT}" + +SPM_BUILD_TARGET ?= "hafnium.bin" + +# do_deploy will install everything listed in this +# variable. It is set by default to SPM_BUILD_TARGET +SPM_INSTALL_TARGET ?= "${SPM_BUILD_TARGET}" + +# Requires CROSS_COMPILE set by hand as there is no configure script + +# Currently SPM uses complier from prebuilts submodule. CROSS_COMPILE will +# be set once prebuilts dependencies are removed. +#export CROSS_COMPILE="${TARGET_PREFIX}" + +# Let the Makefile handle setting up the CFLAGS and LDFLAGS +# as it is a standalone application +CFLAGS[unexport] = "1" +LDFLAGS[unexport] = "1" +AS[unexport] = "1" +LD[unexport] = "1" + +# No configure or install +do_configure[noexec] = "1" +do_install[noexec] = "1" + +# needs bison, bc +DEPENDS_append = " bison-native bc-native" + + +# Handle SPM_DEBUG parameter +EXTRA_OEMAKE += "${@bb.utils.contains('SPM_DEBUG', '1', ' DEBUG=${SPM_DEBUG}', '', d)}" + +do_compile() { + oe_runmake +} + +do_deploy() { + install -d -m 755 ${DEPLOYDIR} + for bldfile in ${SPM_INSTALL_TARGET}; do + if [ "$bldfile" = "all" ]; then + # Target all is not handled by default + bberror "all as SPM_INSTALL_TARGET is not handled" + bberror "Please specify valid targets in SPM_INSTALL_TARGET" + bberror "or rewrite or turn off do_deploy" + exit 1 + elif [ -f ${S}/${SPM_BUILD_DIR_PLAT}/$bldfile ]; then + echo "Install $bldfile" + install -m 0755 ${S}/${SPM_BUILD_DIR_PLAT}/$bldfile \ + ${DEPLOYDIR}/$bldfile + else + bberror "Unsupported SPM_INSTALL_TARGET target $bldfile" + exit 1 + fi + done +} +addtask deploy before do_build after do_compile diff --git a/meta-arm/recipes-bsp/spm/spm_git.bb b/meta-arm/recipes-bsp/spm/spm_git.bb new file mode 100644 index 00000000..4ca5d1fe --- /dev/null +++ b/meta-arm/recipes-bsp/spm/spm_git.bb @@ -0,0 +1,12 @@ +# TF-A spm +# + +# Never select this if another version is available +DEFAULT_PREFERENCE = "-1" + +require spm.inc + +SRC_URI = "gitsm://git.trustedfirmware.org/hafnium/hafnium.git;;protocol=https;name=spm" +SRCREV_FORMAT = "spm" + +S = "${WORKDIR}/git" diff --git a/meta-arm/recipes-bsp/tf-a-tests/tf-a-tests.inc b/meta-arm/recipes-bsp/tf-a-tests/tf-a-tests.inc new file mode 100644 index 00000000..90943b83 --- /dev/null +++ b/meta-arm/recipes-bsp/tf-a-tests/tf-a-tests.inc @@ -0,0 +1,87 @@ +DESCRIPTION = "Trusted Firmware-A Tests" +LICENSE = "BSD & Apache-2.0" + +PROVIDES = "virtual/tf-a-tests" + +PACKAGE_ARCH = "${MACHINE_ARCH}" + +inherit deploy + +COMPATIBLE_MACHINE ?= "invalid" + +# Platform must be set for each machine +TFA_TESTS_PLATFORM ?= "invalid" + +# Build for debug (set TFA_TESTS_DEBUG to 1 to activate) +TFA_TESTS_DEBUG ?= "0" + +# Sub-directory in which to build. +# This must be coherent with BUILD_PLAT make parameter so that deploy can find +# the produced binaries +#TFA_TESTS_BUILD_DIR ?= "build-${TFA_TESTS_PLATFORM}" +TFA_TESTS_BUILD_DIR ?= "build/${TFA_TESTS_PLATFORM}/debug" + +# set BUILD_PLAT depending on configured BUILD_DIR +EXTRA_OEMAKE += "BUILD_PLAT=${TFA_TESTS_BUILD_DIR}" + +# What to build +TFA_TESTS_BUILD_TARGET ?= "tftf" + +# What to install +# do_deploy will install everything listed in this +# variable. It is set by default to TFA_TESTS_BUILD_TARGET +TFA_TESTS_INSTALL_TARGET ?= "${TFA_TESTS_BUILD_TARGET}" + +# Requires CROSS_COMPILE set by hand as there is no configure script +export CROSS_COMPILE="${TARGET_PREFIX}" + +# Let the Makefile handle setting up the CFLAGS and LDFLAGS as it is a standalone application +CFLAGS[unexport] = "1" +LDFLAGS[unexport] = "1" +AS[unexport] = "1" +LD[unexport] = "1" + +# No configure or install +do_configure[noexec] = "1" +do_install[noexec] = "1" + +# We need dtc for dtbs compilation +# We need openssl for fiptool +DEPENDS_append = " dtc-native openssl-native" + +# Add platform parameter +EXTRA_OEMAKE += "PLAT=${TFA_TESTS_PLATFORM}" + +# Handle TFA_TESTS_DEBUG parameter +EXTRA_OEMAKE += "${@bb.utils.contains('TFA_TESTS_DEBUG', '1', ' DEBUG=${TFA_TESTS_DEBUG}', '', d)}" + +do_clean() { + if [ -f ${S}/Makefile ]; then + oe_runmake -C ${S} distclean + fi +} + +do_compile() { + oe_runmake ${TFA_TESTS_BUILD_TARGET} +} + +do_deploy() { + install -d -m 755 ${DEPLOYDIR} + for bldfile in ${TFA_TESTS_INSTALL_TARGET}; do + if [ "$bldfile" = "all" ]; then + # Target all is not handled by default + bberror "all as TFA_TESTS_INSTALL_TARGET is not handled" + bberror "Please specify valid targets in TFA_TESTS_INSTALL_TARGET" + bberror "or rewrite or turn off do_deploy" + exit 1 + elif [ -f ${S}/${TFA_TESTS_BUILD_DIR}/$bldfile ]; then + echo "Install $bldfile" + install -m 0644 ${S}/${TFA_TESTS_BUILD_DIR}/$bldfile \ + ${DEPLOYDIR}/$bldfile + else + bberror "Unsupported TFA_TESTS_INSTALL_TARGET target $bldfile" + exit 1 + fi + done +} +addtask deploy before do_build after do_compile diff --git a/meta-arm/recipes-bsp/tf-a-tests/tf-a-tests_git.bb b/meta-arm/recipes-bsp/tf-a-tests/tf-a-tests_git.bb new file mode 100644 index 00000000..6a061d8f --- /dev/null +++ b/meta-arm/recipes-bsp/tf-a-tests/tf-a-tests_git.bb @@ -0,0 +1,27 @@ +# tf-a-tests +# + +# Never select this if another version is available +DEFAULT_PREFERENCE = "-1" + +require tf-a-tests.inc + +SRC_URI = "git://git.trustedfirmware.org/TF-A/tf-a-tests.git;;protocol=https;name=tfa-tests" +SRCREV_FORMAT = "tfa-tests" + +S = "${WORKDIR}/git" + +# The following hack is needed to fit properly in yocto build environment +# TFA is forcing the host compiler and its flags in the Makefile using := +# assignment for GCC and CFLAGS. +# To properly use the native toolchain of yocto and the right libraries we need +# to pass the proper flags to gcc. This is achieved here by creating a gcc +# script to force passing to gcc the right CFLAGS and LDFLAGS +do_compile_prepend() { + # Create an host gcc build parser to ensure the proper include path is used + mkdir -p bin + echo "#!/usr/bin/env bash" > bin/gcc + echo "$(which ${BUILD_CC}) ${BUILD_CFLAGS} ${BUILD_LDFLAGS} \$@" >> bin/gcc + chmod a+x bin/gcc + export PATH="$PWD/bin:$PATH" +} diff --git a/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.3.bb b/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.3.bb index 7279173b..37619f20 100644 --- a/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.3.bb +++ b/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.3.bb @@ -21,10 +21,10 @@ LIC_FILES_CHKSUM = "file://docs/license.rst;md5=189505435dbcdcc8caa63c46fe93fa89 # Those are used in trusted-firmware-a.inc if TFA_MBEDTLS is set to 1 # -SRC_URI_MBEDTLS = "git://github.com/ARMmbed/mbedtls.git;name=mbedtls;protocol=https;destsuffix=git/mbedtls;branch=mbedtls-2.18" +SRC_URI_MBEDTLS = "git://github.com/ARMmbed/mbedtls.git;name=mbedtls;protocol=https;destsuffix=git/mbedtls;tag=v2.24.0" # mbed TLS v2.18.1 -SRCREV_mbedtls = "ca933c7e0c9e84738b168b6b0feb89af4183a60a" +SRCREV_mbedtls = "v2.24.0" LIC_FILES_CHKSUM_MBEDTLS += " \ file://mbedtls/apache-2.0.txt;md5=3b83ef96387f14655fc854ddc3c6bd57 \