Message ID | 20211117100210.1401-2-maxim.uvarov@linaro.org |
---|---|
State | New |
Headers | show |
Series | [PATCHv5,1/3] optee: updae optee-os.inc to support external TAs | expand |
On Wed, 17 Nov 2021 at 10:02, Maxim Uvarov <maxim.uvarov@linaro.org> wrote: > --- /dev/null > +++ b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch > @@ -0,0 +1,20 @@ > +fix gcc compilation > + > +just fix compilation under gcc. > +Upstream-Status: Submitted [https://github.com/wolfSSL/wolfssl/pull/4563] Good news! This can be Backport now as the change was merged. Please refer to the commit SHA so we can easily verify in the future. > +inherit autotools-brokensep deploy pkgconfig gettext python3native The package doesn't use autotools, so don't inherit autotools. Also suspicious of pkgconfig and gettext. > +B = "${S}" Not needed. > +# fails with j > 1 > +PARALLEL_MAKE = "" Please file a bug with whatever component fails. Ross
On Wed, 17 Nov 2021 at 20:50, Ross Burton <ross@burtonini.com> wrote: > > On Wed, 17 Nov 2021 at 10:02, Maxim Uvarov <maxim.uvarov@linaro.org> wrote: > > --- /dev/null > > +++ b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch > > @@ -0,0 +1,20 @@ > > +fix gcc compilation > > + > > +just fix compilation under gcc. > > +Upstream-Status: Submitted [https://github.com/wolfSSL/wolfssl/pull/4563] > > Good news! This can be Backport now as the change was merged. Please > refer to the commit SHA so we can easily verify in the future. > > > +inherit autotools-brokensep deploy pkgconfig gettext python3native > > The package doesn't use autotools, so don't inherit autotools. > > Also suspicious of pkgconfig and gettext. > ok. > > +B = "${S}" > > Not needed. > ok. > > +# fails with j > 1 > > +PARALLEL_MAKE = "" > > Please file a bug with whatever component fails. > > Ross This chunk is for a long time in our layer and I might not restore what the error was there. Will try to build it a few times. BR, Maxim.
On Wed, Nov 17, 2021 at 5:02 AM Maxim Uvarov <maxim.uvarov@linaro.org> wrote: > > Add software TPM emulated in the OPTEE-OS. > > Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org> > --- > v5: add compatible stings to pass "ci/check-layers.py ci/check-layers.yml" script. > > > .../optee-ftpm/0000-fix-ssl-fallthrough.patch | 20 +++++ > .../0001-add-enum-to-ta-flags.patch | 30 ++++++++ > .../optee-ftpm/optee-ftpm_git.bb | 75 +++++++++++++++++++ > .../optee-ftpm/optee-os_%.bbappend | 14 ++++ > 4 files changed, 139 insertions(+) > create mode 100644 meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch > create mode 100644 meta-arm/recipes-security/optee-ftpm/optee-ftpm/0001-add-enum-to-ta-flags.patch > create mode 100644 meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb > create mode 100644 meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend > > diff --git a/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch > new file mode 100644 > index 0000000..08acde2 > --- /dev/null > +++ b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch > @@ -0,0 +1,20 @@ > +fix gcc compilation > + > +just fix compilation under gcc. > +Upstream-Status: Submitted [https://github.com/wolfSSL/wolfssl/pull/4563] > + > +Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org> > + > +diff --git a/wolfssl/wolfcrypt/types.h b/wolfssl/wolfcrypt/types.h > +index 7b3a953aebda..e156ae5c7909 100755 > +--- a/external/wolfssl/wolfssl/wolfcrypt/types.h > ++++ b/external/wolfssl/wolfssl/wolfcrypt/types.h > +@@ -181,7 +181,7 @@ > + /* GCC 7 has new switch() fall-through detection */ > + #if defined(__GNUC__) > + #if ((__GNUC__ > 7) || ((__GNUC__ == 7) && (__GNUC_MINOR__ >= 1))) > +- #define FALL_THROUGH __attribute__ ((fallthrough)); > ++ #define FALL_THROUGH __attribute__ ((__fallthrough__)); > + #endif > + #endif > + #ifndef FALL_THROUGH > diff --git a/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0001-add-enum-to-ta-flags.patch b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0001-add-enum-to-ta-flags.patch > new file mode 100644 > index 0000000..bbc1107 > --- /dev/null > +++ b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0001-add-enum-to-ta-flags.patch > @@ -0,0 +1,30 @@ > +From 2d00f16058529eb9f4d4d2bcaeed91fd53b43989 Mon Sep 17 00:00:00 2001 > +From: Maxim Uvarov <maxim.uvarov@linaro.org> > +Date: Fri, 17 Apr 2020 12:05:53 +0100 > +Subject: [PATCH 2/2] add enum to ta flags > + > +If we compile this TA into OPTEE-OS we need to define a flag > +that this TA can be discovered on the optee bus. > +Upstream-Status: Submitted [https://github.com/microsoft/MSRSec/pull/34] > + > +Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org> > +--- > + TAs/optee_ta/fTPM/user_ta_header_defines.h | 2 +- > + 1 file changed, 1 insertion(+), 1 deletion(-) > + > +diff --git a/TAs/optee_ta/fTPM/user_ta_header_defines.h b/TAs/optee_ta/fTPM/user_ta_header_defines.h > +index 6ff62d1..685b54a 100644 > +--- a/TAs/optee_ta/fTPM/user_ta_header_defines.h > ++++ b/TAs/optee_ta/fTPM/user_ta_header_defines.h > +@@ -44,7 +44,7 @@ > + > + #define TA_UUID TA_FTPM_UUID > + > +-#define TA_FLAGS (TA_FLAG_SINGLE_INSTANCE | TA_FLAG_INSTANCE_KEEP_ALIVE ) > ++#define TA_FLAGS (TA_FLAG_SINGLE_INSTANCE | TA_FLAG_INSTANCE_KEEP_ALIVE | TA_FLAG_DEVICE_ENUM_SUPP) > + #define TA_STACK_SIZE (64 * 1024) > + #define TA_DATA_SIZE (64 * 1024) > + > +-- > +2.17.1 > + > diff --git a/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb b/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb > new file mode 100644 > index 0000000..ee9dc61 > --- /dev/null > +++ b/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb > @@ -0,0 +1,75 @@ > +SUMMARY = "OPTEE fTPM Microsoft TA" > +DESCRIPTION = "TCG reference implementation of the TPM 2.0 Specification." > +HOMEPAGE = "https://github.com/microsoft/ms-tpm-20-ref/" > + > +COMPATIBLE_MACHINE ?= "invalid" > +COMPATIBLE_MACHINE:aarch64 = "(.*)" > +COMPATIBLE_MACHINE:qemuarm64-secureboot = "qemuarm64" I added the following here and got it to pass the failing qemuarm64-secureboot clang machines (see https://gitlab.com/jonmason00/meta-arm/-/pipelines/410996476): #FIXME - doesn't currently work with clang TOOLCHAIN = "gcc" > + > +inherit autotools-brokensep deploy pkgconfig gettext python3native > + > +LICENSE = "MIT" > +LIC_FILES_CHKSUM = "file://${S}/LICENSE;md5=27e94c0280987ab296b0b8dd02ab9fe5" > + > +DEPENDS = "python3-pycryptodome-native python3-pycryptodomex-native python3-pyelftools-native" > +DEPENDS += " optee-os-tadevkit" > + > +FTPM_UUID="bc50d971-d4c9-42c4-82cb-343fb7f37896" > + > +# SRC_URI = "git://github.com/Microsoft/ms-tpm-20-ref;branch=master" > +# Since this is not built as a pseudo TA, we can only use it as a kernel module and not built in. > +# The TEE supplicant is also needed to provide access to secure storage. > +# Secure storage access required by OP-TEE fTPM TA > +# is provided via OP-TEE supplicant that's not available during boot. > +# Fix this once we replace this with the MS implementation > +SRC_URI = "gitsm://github.com/microsoft/MSRSec;protocol=https;branch=master \ > + file://0000-fix-ssl-fallthrough.patch \ > + file://0001-add-enum-to-ta-flags.patch" > +SRCREV = "76f81b36efbb1a366b0d382bc0defe677f1f0534" > + > +S = "${WORKDIR}/git" > + > +OPTEE_CLIENT_EXPORT = "${STAGING_DIR_HOST}${prefix}" > +TEEC_EXPORT = "${STAGING_DIR_HOST}${prefix}" > +TA_DEV_KIT_DIR = "${STAGING_INCDIR}/optee/export-user_ta" > + > +EXTRA_OEMAKE += '\ > + CFG_FTPM_USE_WOLF=y \ > + TA_DEV_KIT_DIR=${TA_DEV_KIT_DIR} \ > + TA_CROSS_COMPILE=${TARGET_PREFIX} \ > + CFLAGS="${CFLAGS} --sysroot=${STAGING_DIR_HOST} -I${WORKDIR}/optee-os" \ > +' > + > +EXTRA_OEMAKE:append:aarch64:qemuall = "\ > + CFG_ARM64_ta_arm64=y \ > +" > + > +B = "${S}" > + > +# fails with j > 1 > +PARALLEL_MAKE = "" > + > +do_compile() { > + sed -i 's/-mcpu=$(TA_CPU)//' TAs/optee_ta/fTPM/sub.mk > + # there's also a secure variable storage TA called authvars > + cd ${S}/TAs/optee_ta > + oe_runmake ftpm > +} > + > +do_install () { > + mkdir -p ${D}/lib/optee_armtz > + install -D -p -m 0644 ${S}/TAs/optee_ta/out/fTPM/${FTPM_UUID}.ta ${D}/lib/optee_armtz/ > +} > + > +do_deploy () { > + install -d ${DEPLOYDIR}/optee > + install -D -p -m 0644 ${S}/TAs/optee_ta/out/fTPM/${FTPM_UUID}.stripped.elf ${DEPLOYDIR}/optee/ > +} > + > +addtask deploy before do_build after do_install > + > +FILES:${PN} += "${nonarch_base_libdir}/optee_armtz/${FTPM_UUID}.ta" > + > +# Imports machine specific configs from staging to build > +PACKAGE_ARCH = "${MACHINE_ARCH}" > +INSANE_SKIP:${PN} += "ldflags" > diff --git a/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend b/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend > new file mode 100644 > index 0000000..0cfa949 > --- /dev/null > +++ b/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend > @@ -0,0 +1,14 @@ > +FTPM_UUID="bc50d971-d4c9-42c4-82cb-343fb7f37896" > + > +DEPENDS:append = "\ > + ${@bb.utils.contains('MACHINE_FEATURES', \ > + 'optee-ftpm', \ > + 'optee-ftpm', \ > + '' , \ > + d)}" > + > +EXTRA_OEMAKE:append = "${@bb.utils.contains('MACHINE_FEATURES', \ > + 'optee-ftpm', \ > + 'CFG_EARLY_TA=y EARLY_TA_PATHS="${DEPLOY_DIR_IMAGE}/optee/${FTPM_UUID}.stripped.elf"', \ > + '', \ > + d)} " > -- > 2.17.1 > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#2415): https://lists.yoctoproject.org/g/meta-arm/message/2415 > Mute This Topic: https://lists.yoctoproject.org/mt/87116206/3616920 > Group Owner: meta-arm+owner@lists.yoctoproject.org > Unsubscribe: https://lists.yoctoproject.org/g/meta-arm/unsub [jdmason@kudzu.us] > -=-=-=-=-=-=-=-=-=-=-=- >
On Wed, 17 Nov 2021 at 23:51, Jon Mason <jdmason@kudzu.us> wrote: > > On Wed, Nov 17, 2021 at 5:02 AM Maxim Uvarov <maxim.uvarov@linaro.org> wrote: > > > > Add software TPM emulated in the OPTEE-OS. > > > > Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org> > > --- > > v5: add compatible stings to pass "ci/check-layers.py ci/check-layers.yml" script. > > > > > > .../optee-ftpm/0000-fix-ssl-fallthrough.patch | 20 +++++ > > .../0001-add-enum-to-ta-flags.patch | 30 ++++++++ > > .../optee-ftpm/optee-ftpm_git.bb | 75 +++++++++++++++++++ > > .../optee-ftpm/optee-os_%.bbappend | 14 ++++ > > 4 files changed, 139 insertions(+) > > create mode 100644 meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch > > create mode 100644 meta-arm/recipes-security/optee-ftpm/optee-ftpm/0001-add-enum-to-ta-flags.patch > > create mode 100644 meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb > > create mode 100644 meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend > > > > diff --git a/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch > > new file mode 100644 > > index 0000000..08acde2 > > --- /dev/null > > +++ b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch > > @@ -0,0 +1,20 @@ > > +fix gcc compilation > > + > > +just fix compilation under gcc. > > +Upstream-Status: Submitted [https://github.com/wolfSSL/wolfssl/pull/4563] > > + > > +Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org> > > + > > +diff --git a/wolfssl/wolfcrypt/types.h b/wolfssl/wolfcrypt/types.h > > +index 7b3a953aebda..e156ae5c7909 100755 > > +--- a/external/wolfssl/wolfssl/wolfcrypt/types.h > > ++++ b/external/wolfssl/wolfssl/wolfcrypt/types.h > > +@@ -181,7 +181,7 @@ > > + /* GCC 7 has new switch() fall-through detection */ > > + #if defined(__GNUC__) > > + #if ((__GNUC__ > 7) || ((__GNUC__ == 7) && (__GNUC_MINOR__ >= 1))) > > +- #define FALL_THROUGH __attribute__ ((fallthrough)); > > ++ #define FALL_THROUGH __attribute__ ((__fallthrough__)); > > + #endif > > + #endif > > + #ifndef FALL_THROUGH > > diff --git a/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0001-add-enum-to-ta-flags.patch b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0001-add-enum-to-ta-flags.patch > > new file mode 100644 > > index 0000000..bbc1107 > > --- /dev/null > > +++ b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0001-add-enum-to-ta-flags.patch > > @@ -0,0 +1,30 @@ > > +From 2d00f16058529eb9f4d4d2bcaeed91fd53b43989 Mon Sep 17 00:00:00 2001 > > +From: Maxim Uvarov <maxim.uvarov@linaro.org> > > +Date: Fri, 17 Apr 2020 12:05:53 +0100 > > +Subject: [PATCH 2/2] add enum to ta flags > > + > > +If we compile this TA into OPTEE-OS we need to define a flag > > +that this TA can be discovered on the optee bus. > > +Upstream-Status: Submitted [https://github.com/microsoft/MSRSec/pull/34] > > + > > +Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org> > > +--- > > + TAs/optee_ta/fTPM/user_ta_header_defines.h | 2 +- > > + 1 file changed, 1 insertion(+), 1 deletion(-) > > + > > +diff --git a/TAs/optee_ta/fTPM/user_ta_header_defines.h b/TAs/optee_ta/fTPM/user_ta_header_defines.h > > +index 6ff62d1..685b54a 100644 > > +--- a/TAs/optee_ta/fTPM/user_ta_header_defines.h > > ++++ b/TAs/optee_ta/fTPM/user_ta_header_defines.h > > +@@ -44,7 +44,7 @@ > > + > > + #define TA_UUID TA_FTPM_UUID > > + > > +-#define TA_FLAGS (TA_FLAG_SINGLE_INSTANCE | TA_FLAG_INSTANCE_KEEP_ALIVE ) > > ++#define TA_FLAGS (TA_FLAG_SINGLE_INSTANCE | TA_FLAG_INSTANCE_KEEP_ALIVE | TA_FLAG_DEVICE_ENUM_SUPP) > > + #define TA_STACK_SIZE (64 * 1024) > > + #define TA_DATA_SIZE (64 * 1024) > > + > > +-- > > +2.17.1 > > + > > diff --git a/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb b/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb > > new file mode 100644 > > index 0000000..ee9dc61 > > --- /dev/null > > +++ b/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb > > @@ -0,0 +1,75 @@ > > +SUMMARY = "OPTEE fTPM Microsoft TA" > > +DESCRIPTION = "TCG reference implementation of the TPM 2.0 Specification." > > +HOMEPAGE = "https://github.com/microsoft/ms-tpm-20-ref/" > > + > > +COMPATIBLE_MACHINE ?= "invalid" > > +COMPATIBLE_MACHINE:aarch64 = "(.*)" > > +COMPATIBLE_MACHINE:qemuarm64-secureboot = "qemuarm64" > > I added the following here and got it to pass the failing > qemuarm64-secureboot clang machines (see > https://gitlab.com/jonmason00/meta-arm/-/pipelines/410996476): > #FIXME - doesn't currently work with clang > TOOLCHAIN = "gcc" > Ok. Thanks, I will add that. > > > > + > > +inherit autotools-brokensep deploy pkgconfig gettext python3native > > + > > +LICENSE = "MIT" > > +LIC_FILES_CHKSUM = "file://${S}/LICENSE;md5=27e94c0280987ab296b0b8dd02ab9fe5" > > + > > +DEPENDS = "python3-pycryptodome-native python3-pycryptodomex-native python3-pyelftools-native" > > +DEPENDS += " optee-os-tadevkit" > > + > > +FTPM_UUID="bc50d971-d4c9-42c4-82cb-343fb7f37896" > > + > > +# SRC_URI = "git://github.com/Microsoft/ms-tpm-20-ref;branch=master" > > +# Since this is not built as a pseudo TA, we can only use it as a kernel module and not built in. > > +# The TEE supplicant is also needed to provide access to secure storage. > > +# Secure storage access required by OP-TEE fTPM TA > > +# is provided via OP-TEE supplicant that's not available during boot. > > +# Fix this once we replace this with the MS implementation > > +SRC_URI = "gitsm://github.com/microsoft/MSRSec;protocol=https;branch=master \ > > + file://0000-fix-ssl-fallthrough.patch \ > > + file://0001-add-enum-to-ta-flags.patch" > > +SRCREV = "76f81b36efbb1a366b0d382bc0defe677f1f0534" > > + > > +S = "${WORKDIR}/git" > > + > > +OPTEE_CLIENT_EXPORT = "${STAGING_DIR_HOST}${prefix}" > > +TEEC_EXPORT = "${STAGING_DIR_HOST}${prefix}" > > +TA_DEV_KIT_DIR = "${STAGING_INCDIR}/optee/export-user_ta" > > + > > +EXTRA_OEMAKE += '\ > > + CFG_FTPM_USE_WOLF=y \ > > + TA_DEV_KIT_DIR=${TA_DEV_KIT_DIR} \ > > + TA_CROSS_COMPILE=${TARGET_PREFIX} \ > > + CFLAGS="${CFLAGS} --sysroot=${STAGING_DIR_HOST} -I${WORKDIR}/optee-os" \ > > +' > > + > > +EXTRA_OEMAKE:append:aarch64:qemuall = "\ > > + CFG_ARM64_ta_arm64=y \ > > +" > > + > > +B = "${S}" > > + > > +# fails with j > 1 > > +PARALLEL_MAKE = "" > > + > > +do_compile() { > > + sed -i 's/-mcpu=$(TA_CPU)//' TAs/optee_ta/fTPM/sub.mk > > + # there's also a secure variable storage TA called authvars > > + cd ${S}/TAs/optee_ta > > + oe_runmake ftpm > > +} > > + > > +do_install () { > > + mkdir -p ${D}/lib/optee_armtz > > + install -D -p -m 0644 ${S}/TAs/optee_ta/out/fTPM/${FTPM_UUID}.ta ${D}/lib/optee_armtz/ > > +} > > + > > +do_deploy () { > > + install -d ${DEPLOYDIR}/optee > > + install -D -p -m 0644 ${S}/TAs/optee_ta/out/fTPM/${FTPM_UUID}.stripped.elf ${DEPLOYDIR}/optee/ > > +} > > + > > +addtask deploy before do_build after do_install > > + > > +FILES:${PN} += "${nonarch_base_libdir}/optee_armtz/${FTPM_UUID}.ta" > > + > > +# Imports machine specific configs from staging to build > > +PACKAGE_ARCH = "${MACHINE_ARCH}" > > +INSANE_SKIP:${PN} += "ldflags" > > diff --git a/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend b/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend > > new file mode 100644 > > index 0000000..0cfa949 > > --- /dev/null > > +++ b/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend > > @@ -0,0 +1,14 @@ > > +FTPM_UUID="bc50d971-d4c9-42c4-82cb-343fb7f37896" > > + > > +DEPENDS:append = "\ > > + ${@bb.utils.contains('MACHINE_FEATURES', \ > > + 'optee-ftpm', \ > > + 'optee-ftpm', \ > > + '' , \ > > + d)}" > > + > > +EXTRA_OEMAKE:append = "${@bb.utils.contains('MACHINE_FEATURES', \ > > + 'optee-ftpm', \ > > + 'CFG_EARLY_TA=y EARLY_TA_PATHS="${DEPLOY_DIR_IMAGE}/optee/${FTPM_UUID}.stripped.elf"', \ > > + '', \ > > + d)} " > > -- > > 2.17.1 > > > > > > -=-=-=-=-=-=-=-=-=-=-=- > > Links: You receive all messages sent to this group. > > View/Reply Online (#2415): https://lists.yoctoproject.org/g/meta-arm/message/2415 > > Mute This Topic: https://lists.yoctoproject.org/mt/87116206/3616920 > > Group Owner: meta-arm+owner@lists.yoctoproject.org > > Unsubscribe: https://lists.yoctoproject.org/g/meta-arm/unsub [jdmason@kudzu.us] > > -=-=-=-=-=-=-=-=-=-=-=- > >
diff --git a/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch new file mode 100644 index 0000000..08acde2 --- /dev/null +++ b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch @@ -0,0 +1,20 @@ +fix gcc compilation + +just fix compilation under gcc. +Upstream-Status: Submitted [https://github.com/wolfSSL/wolfssl/pull/4563] + +Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org> + +diff --git a/wolfssl/wolfcrypt/types.h b/wolfssl/wolfcrypt/types.h +index 7b3a953aebda..e156ae5c7909 100755 +--- a/external/wolfssl/wolfssl/wolfcrypt/types.h ++++ b/external/wolfssl/wolfssl/wolfcrypt/types.h +@@ -181,7 +181,7 @@ + /* GCC 7 has new switch() fall-through detection */ + #if defined(__GNUC__) + #if ((__GNUC__ > 7) || ((__GNUC__ == 7) && (__GNUC_MINOR__ >= 1))) +- #define FALL_THROUGH __attribute__ ((fallthrough)); ++ #define FALL_THROUGH __attribute__ ((__fallthrough__)); + #endif + #endif + #ifndef FALL_THROUGH diff --git a/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0001-add-enum-to-ta-flags.patch b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0001-add-enum-to-ta-flags.patch new file mode 100644 index 0000000..bbc1107 --- /dev/null +++ b/meta-arm/recipes-security/optee-ftpm/optee-ftpm/0001-add-enum-to-ta-flags.patch @@ -0,0 +1,30 @@ +From 2d00f16058529eb9f4d4d2bcaeed91fd53b43989 Mon Sep 17 00:00:00 2001 +From: Maxim Uvarov <maxim.uvarov@linaro.org> +Date: Fri, 17 Apr 2020 12:05:53 +0100 +Subject: [PATCH 2/2] add enum to ta flags + +If we compile this TA into OPTEE-OS we need to define a flag +that this TA can be discovered on the optee bus. +Upstream-Status: Submitted [https://github.com/microsoft/MSRSec/pull/34] + +Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org> +--- + TAs/optee_ta/fTPM/user_ta_header_defines.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/TAs/optee_ta/fTPM/user_ta_header_defines.h b/TAs/optee_ta/fTPM/user_ta_header_defines.h +index 6ff62d1..685b54a 100644 +--- a/TAs/optee_ta/fTPM/user_ta_header_defines.h ++++ b/TAs/optee_ta/fTPM/user_ta_header_defines.h +@@ -44,7 +44,7 @@ + + #define TA_UUID TA_FTPM_UUID + +-#define TA_FLAGS (TA_FLAG_SINGLE_INSTANCE | TA_FLAG_INSTANCE_KEEP_ALIVE ) ++#define TA_FLAGS (TA_FLAG_SINGLE_INSTANCE | TA_FLAG_INSTANCE_KEEP_ALIVE | TA_FLAG_DEVICE_ENUM_SUPP) + #define TA_STACK_SIZE (64 * 1024) + #define TA_DATA_SIZE (64 * 1024) + +-- +2.17.1 + diff --git a/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb b/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb new file mode 100644 index 0000000..ee9dc61 --- /dev/null +++ b/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb @@ -0,0 +1,75 @@ +SUMMARY = "OPTEE fTPM Microsoft TA" +DESCRIPTION = "TCG reference implementation of the TPM 2.0 Specification." +HOMEPAGE = "https://github.com/microsoft/ms-tpm-20-ref/" + +COMPATIBLE_MACHINE ?= "invalid" +COMPATIBLE_MACHINE:aarch64 = "(.*)" +COMPATIBLE_MACHINE:qemuarm64-secureboot = "qemuarm64" + +inherit autotools-brokensep deploy pkgconfig gettext python3native + +LICENSE = "MIT" +LIC_FILES_CHKSUM = "file://${S}/LICENSE;md5=27e94c0280987ab296b0b8dd02ab9fe5" + +DEPENDS = "python3-pycryptodome-native python3-pycryptodomex-native python3-pyelftools-native" +DEPENDS += " optee-os-tadevkit" + +FTPM_UUID="bc50d971-d4c9-42c4-82cb-343fb7f37896" + +# SRC_URI = "git://github.com/Microsoft/ms-tpm-20-ref;branch=master" +# Since this is not built as a pseudo TA, we can only use it as a kernel module and not built in. +# The TEE supplicant is also needed to provide access to secure storage. +# Secure storage access required by OP-TEE fTPM TA +# is provided via OP-TEE supplicant that's not available during boot. +# Fix this once we replace this with the MS implementation +SRC_URI = "gitsm://github.com/microsoft/MSRSec;protocol=https;branch=master \ + file://0000-fix-ssl-fallthrough.patch \ + file://0001-add-enum-to-ta-flags.patch" +SRCREV = "76f81b36efbb1a366b0d382bc0defe677f1f0534" + +S = "${WORKDIR}/git" + +OPTEE_CLIENT_EXPORT = "${STAGING_DIR_HOST}${prefix}" +TEEC_EXPORT = "${STAGING_DIR_HOST}${prefix}" +TA_DEV_KIT_DIR = "${STAGING_INCDIR}/optee/export-user_ta" + +EXTRA_OEMAKE += '\ + CFG_FTPM_USE_WOLF=y \ + TA_DEV_KIT_DIR=${TA_DEV_KIT_DIR} \ + TA_CROSS_COMPILE=${TARGET_PREFIX} \ + CFLAGS="${CFLAGS} --sysroot=${STAGING_DIR_HOST} -I${WORKDIR}/optee-os" \ +' + +EXTRA_OEMAKE:append:aarch64:qemuall = "\ + CFG_ARM64_ta_arm64=y \ +" + +B = "${S}" + +# fails with j > 1 +PARALLEL_MAKE = "" + +do_compile() { + sed -i 's/-mcpu=$(TA_CPU)//' TAs/optee_ta/fTPM/sub.mk + # there's also a secure variable storage TA called authvars + cd ${S}/TAs/optee_ta + oe_runmake ftpm +} + +do_install () { + mkdir -p ${D}/lib/optee_armtz + install -D -p -m 0644 ${S}/TAs/optee_ta/out/fTPM/${FTPM_UUID}.ta ${D}/lib/optee_armtz/ +} + +do_deploy () { + install -d ${DEPLOYDIR}/optee + install -D -p -m 0644 ${S}/TAs/optee_ta/out/fTPM/${FTPM_UUID}.stripped.elf ${DEPLOYDIR}/optee/ +} + +addtask deploy before do_build after do_install + +FILES:${PN} += "${nonarch_base_libdir}/optee_armtz/${FTPM_UUID}.ta" + +# Imports machine specific configs from staging to build +PACKAGE_ARCH = "${MACHINE_ARCH}" +INSANE_SKIP:${PN} += "ldflags" diff --git a/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend b/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend new file mode 100644 index 0000000..0cfa949 --- /dev/null +++ b/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend @@ -0,0 +1,14 @@ +FTPM_UUID="bc50d971-d4c9-42c4-82cb-343fb7f37896" + +DEPENDS:append = "\ + ${@bb.utils.contains('MACHINE_FEATURES', \ + 'optee-ftpm', \ + 'optee-ftpm', \ + '' , \ + d)}" + +EXTRA_OEMAKE:append = "${@bb.utils.contains('MACHINE_FEATURES', \ + 'optee-ftpm', \ + 'CFG_EARLY_TA=y EARLY_TA_PATHS="${DEPLOY_DIR_IMAGE}/optee/${FTPM_UUID}.stripped.elf"', \ + '', \ + d)} "
Add software TPM emulated in the OPTEE-OS. Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org> --- v5: add compatible stings to pass "ci/check-layers.py ci/check-layers.yml" script. .../optee-ftpm/0000-fix-ssl-fallthrough.patch | 20 +++++ .../0001-add-enum-to-ta-flags.patch | 30 ++++++++ .../optee-ftpm/optee-ftpm_git.bb | 75 +++++++++++++++++++ .../optee-ftpm/optee-os_%.bbappend | 14 ++++ 4 files changed, 139 insertions(+) create mode 100644 meta-arm/recipes-security/optee-ftpm/optee-ftpm/0000-fix-ssl-fallthrough.patch create mode 100644 meta-arm/recipes-security/optee-ftpm/optee-ftpm/0001-add-enum-to-ta-flags.patch create mode 100644 meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb create mode 100644 meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend