Merge pull request #1281 from nsdrude/kirkstone

[Backport Kirkstone] optee

5 files changed, 87 insertions, 23 deletions

diff --git a/conf/machine/include/imx-base.inc b/conf/machine/include/imx-base.inc
index 80027072..e9b751e0 100644
--- a/conf/machine/include/imx-base.inc
+++ b/conf/machine/include/imx-base.inc
@@ -490,9 +490,9 @@ PREFERRED_VERSION_vulkan-loader:imxvulkan  ??= "1.2.182.0"
 PREFERRED_VERSION_vulkan-tools:imxvulkan   ??= "1.2.182.0"
 
 # Use i.MX optee Version
-PREFERRED_VERSION_optee-os:mx8-nxp-bsp     ??= "3.15.0.imx"
-PREFERRED_VERSION_optee-client:mx8-nxp-bsp ??= "3.15.0.imx"
-PREFERRED_VERSION_optee-test:mx8-nxp-bsp   ??= "3.15.0.imx"
+PREFERRED_VERSION_optee-os:mx8-nxp-bsp     ??= "3.17.0.imx"
+PREFERRED_VERSION_optee-client:mx8-nxp-bsp ??= "3.17.0.imx"
+PREFERRED_VERSION_optee-test:mx8-nxp-bsp   ??= "3.17.0.imx"
 
 #Use i.MX opencv Version for mx8
 PREFERRED_VERSION_opencv:mx8-nxp-bsp ??= "4.5.2.imx"
diff --git a/recipes-security/optee-imx/optee-client_3.15.0.imx.bb b/recipes-security/optee-imx/optee-client_3.17.0.imx.bb
index 53ee5bc4..53ee5bc4 100644
--- a/recipes-security/optee-imx/optee-client_3.15.0.imx.bb
+++ b/recipes-security/optee-imx/optee-client_3.17.0.imx.bb
diff --git a/recipes-security/optee-imx/optee-os/0008-no-warn-rwx-segments.patch b/recipes-security/optee-imx/optee-os/0008-no-warn-rwx-segments.patch
new file mode 100644
index 00000000..1dd70b31
--- /dev/null
+++ b/recipes-security/optee-imx/optee-os/0008-no-warn-rwx-segments.patch
@@ -0,0 +1,64 @@
+Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
+Upstream-Status: Backport [https://github.com/OP-TEE/optee_os/pull/5474]
+
+From 0b8a917fa51a366806edc0f04b88cd23b24098c4 Mon Sep 17 00:00:00 2001
+From: Jerome Forissier <jerome.forissier@linaro.org>
+Date: Fri, 5 Aug 2022 09:48:03 +0200
+Subject: [PATCH] core: link: add --no-warn-rwx-segments
+
+binutils ld.bfd generates one RWX LOAD segment by merging several sections
+with mixed R/W/X attributes (.text, .rodata, .data). After version 2.38 it
+also warns by default when that happens [1], which breaks the build due to
+--fatal-warnings. The RWX segment is not a problem for the TEE core, since
+that information is not used to set memory permissions. Therefore, silence
+the warning.
+
+Link: [1] https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107
+Link: https://sourceware.org/bugzilla/show_bug.cgi?id=29448
+Reported-by: Dominique Martinet <dominique.martinet@atmark-techno.com>
+Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
+Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
+---
+ core/arch/arm/kernel/link.mk | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/core/arch/arm/kernel/link.mk b/core/arch/arm/kernel/link.mk
+index 7eed333a32..c39d43cbfc 100644
+--- a/core/arch/arm/kernel/link.mk
++++ b/core/arch/arm/kernel/link.mk
+@@ -31,6 +31,7 @@ link-ldflags += -T $(link-script-pp) -Map=$(link-out-dir)/tee.map
+ link-ldflags += --sort-section=alignment
+ link-ldflags += --fatal-warnings
+ link-ldflags += --gc-sections
++link-ldflags += $(call ld-option,--no-warn-rwx-segments)
+ 
+ link-ldadd  = $(LDADD)
+ link-ldadd += $(ldflags-external)
+@@ -55,6 +56,7 @@ link-script-cppflags := \
+                $(cppflagscore))
+ 
+ ldargs-all_objs := -T $(link-script-dummy) --no-check-sections \
++                  $(call ld-option,--no-warn-rwx-segments) \
+                   $(link-objs) $(link-ldadd) $(libgcccore)
+ cleanfiles += $(link-out-dir)/all_objs.o
+ $(link-out-dir)/all_objs.o: $(objs) $(libdeps) $(MAKEFILE_LIST)
+@@ -67,7 +69,8 @@ $(link-out-dir)/unpaged_entries.txt: $(link-out-dir)/all_objs.o
+        $(q)$(NMcore) $< | \
+                $(AWK) '/ ____keep_pager/ { printf "-u%s ", $$3 }' > $@
+ 
+-unpaged-ldargs = -T $(link-script-dummy) --no-check-sections --gc-sections
++unpaged-ldargs := -T $(link-script-dummy) --no-check-sections --gc-sections \
++                $(call ld-option,--no-warn-rwx-segments)
+ unpaged-ldadd := $(objs) $(link-ldadd) $(libgcccore)
+ cleanfiles += $(link-out-dir)/unpaged.o
+ $(link-out-dir)/unpaged.o: $(link-out-dir)/unpaged_entries.txt
+@@ -95,7 +98,8 @@ $(link-out-dir)/init_entries.txt: $(link-out-dir)/all_objs.o
+        $(q)$(NMcore) $< | \
+                $(AWK) '/ ____keep_init/ { printf "-u%s ", $$3 }' > $@
+ 
+-init-ldargs := -T $(link-script-dummy) --no-check-sections --gc-sections
++init-ldargs := -T $(link-script-dummy) --no-check-sections --gc-sections \
++              $(call ld-option,--no-warn-rwx-segments)
+ init-ldadd := $(link-objs-init) $(link-out-dir)/version.o  $(link-ldadd) \
+              $(libgcccore)
+ cleanfiles += $(link-out-dir)/init.o
diff --git a/recipes-security/optee-imx/optee-os_3.15.0.imx.bb b/recipes-security/optee-imx/optee-os_3.17.0.imx.bb
index 6d10b93d..93e0ff6e 100644
--- a/recipes-security/optee-imx/optee-os_3.15.0.imx.bb
+++ b/recipes-security/optee-imx/optee-os_3.17.0.imx.bb
@@ -6,12 +6,15 @@ HOMEPAGE = "http://www.optee.org/"
 LICENSE = "BSD-2-Clause"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=c1f21c4f72f372ef38a5a4aee55ec173"
 
-DEPENDS = "python3-pycryptodomex-native python3-pyelftools-native u-boot-mkimage-native"
+DEPENDS = "python3-cryptography-native python3-pyelftools-native u-boot-mkimage-native"
 
-SRCBRANCH = "lf-5.15.5_1.0.0"
 SRC_URI = "git://source.codeaurora.org/external/imx/imx-optee-os.git;protocol=https;branch=${SRCBRANCH}"
+SRCBRANCH = "lf-5.15.32_2.0.0"
+SRCREV = "984996422c25c99ebfc5194c1bb393028605bb0c"
 
-SRCREV = "807629a0889ad5e888f1fd187932ab7f701ddf8c"
+SRC_URI:append = " \
+    file://0008-no-warn-rwx-segments.patch \
+    "
 
 S = "${WORKDIR}/git"
 
@@ -24,10 +27,9 @@ PLATFORM_FLAVOR                   = "${@d.getVar('MACHINE')[1:]}"
 PLATFORM_FLAVOR:imx6qdlsabresd    = "mx6qsabresd"
 PLATFORM_FLAVOR:imx6qdlsabreauto  = "mx6qsabreauto"
 PLATFORM_FLAVOR:imx6qpdlsolox     = "mx6qsabresd"
-PLATFORM_FLAVOR:imx6ul            = "mx6ulevk"
-PLATFORM_FLAVOR:imx6ull           = "mx6ullevk"
-PLATFORM_FLAVOR:imx6ull           = "mx6ullevk"
-PLATFORM_FLAVOR:imx6ulz           = "mx6ulzevk"
+PLATFORM_FLAVOR:mx6ul-nxp-bsp     = "mx6ulevk"
+PLATFORM_FLAVOR:mx6ull-nxp-bsp    = "mx6ullevk"
+PLATFORM_FLAVOR:mx6ulz-nxp-bsp    = "mx6ulzevk"
 PLATFORM_FLAVOR:mx8mq-nxp-bsp     = "mx8mqevk"
 PLATFORM_FLAVOR:mx8mm-nxp-bsp     = "mx8mmevk"
 PLATFORM_FLAVOR:mx8mn-nxp-bsp     = "mx8mnevk"
@@ -49,13 +51,13 @@ OPTEE_ARCH:aarch64 = "arm64"
 # When defining CROSS_COMPILE and CROSS_COMPILE64, we assure that
 # any 32 or 64 bits builds will pass
 EXTRA_OEMAKE = " \
-        PLATFORM=imx \
-        PLATFORM_FLAVOR=${PLATFORM_FLAVOR} \
-        CROSS_COMPILE=${HOST_PREFIX} \
-        CROSS_COMPILE64=${HOST_PREFIX} \
-        CFG_TEE_TA_LOG_LEVEL=0 \
-        CFG_TEE_CORE_LOG_LEVEL=0 \
-        -C ${S} O=${B}\
+    PLATFORM=imx-${PLATFORM_FLAVOR} \
+    CROSS_COMPILE=${HOST_PREFIX} \
+    CROSS_COMPILE64=${HOST_PREFIX} \
+    CFG_TEE_TA_LOG_LEVEL=0 \
+    CFG_TEE_CORE_LOG_LEVEL=0 \
+    OPENSSL_MODULES=${STAGING_LIBDIR_NATIVE}/ossl-modules \
+    -C ${S} O=${B} \
 "
 
 LDFLAGS = ""
diff --git a/recipes-security/optee-imx/optee-test_3.15.0.imx.bb b/recipes-security/optee-imx/optee-test_3.17.0.imx.bb
index a3649d74..54f92d72 100644
--- a/recipes-security/optee-imx/optee-test_3.15.0.imx.bb
+++ b/recipes-security/optee-imx/optee-test_3.17.0.imx.bb
@@ -6,17 +6,15 @@ HOMEPAGE = "http://www.optee.org/"
 LICENSE = "BSD-2-Clause & GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://LICENSE.md;md5=daa2bcccc666345ab8940aab1315a4fa"
 
-DEPENDS = "python3-pycryptodome-native python3-pycryptodomex-native optee-os optee-client openssl"
-
-SRCBRANCH = "lf-5.15.5_1.0.0"
+DEPENDS = "python3-cryptography-native optee-os optee-client openssl"
 
 SRC_URI = "git://source.codeaurora.org/external/imx/imx-optee-test.git;protocol=https;branch=${SRCBRANCH}"
+SRCBRANCH = "lf-5.15.32_2.0.0"
+SRCREV = "e064126a9769f168d1d0e178b74955e6648683b4"
 
 S = "${WORKDIR}/git"
 B = "${WORKDIR}/build"
 
-SRCREV = "e9d8bf6ee121d6686e6e409c727caee76496bb86"
-
 inherit python3native features_check
 
 REQUIRED_MACHINE_FEATURES = "optee"
@@ -29,11 +27,11 @@ CXXFLAGS += "--sysroot=${STAGING_DIR_HOST}"
 
 EXTRA_OEMAKE = " \
     TA_DEV_KIT_DIR=${STAGING_INCDIR}/optee/export-user_ta_${OPTEE_ARCH}/ \
-    ARCH=${OPTEE_ARCH} \
     OPTEE_CLIENT_EXPORT=${STAGING_DIR_HOST}${exec_prefix} \
     CROSS_COMPILE_HOST=${HOST_PREFIX} \
     CROSS_COMPILE_TA=${HOST_PREFIX} \
     CROSS_COMPILE=${HOST_PREFIX} \
+    OPENSSL_MODULES=${STAGING_LIBDIR_NATIVE}/ossl-modules \
     -C ${S} O=${B} \
 "