Signed-off-by: Arnaud de Grandmaison <arnaud.degrandmaison@arm.com>

A configuration with OPTEE in secure EL1 with TF-A in secure EL3 without
FF-A and secure EL2/Hafnium is being adding. Let us add the same into
the test vector for build and boot test coverage.

There is no ACPI binding for this non-FFA configuration of running OPTEE
and hence no ACPI coverage needed for it.

Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>

This is base configuration to run OPTEE in the secure world. It doesn't
include any FF-A or S-EL2/Hafnium. This is useful to compare it with
other configurations that include FF-A and/or Hafnium in S-EL2.

Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>

This config adds support to build OPTEE OS. Currently only 64-bit
mode is added as it is the one widely used and also to avoid dependency
on 32-bit compilers.

Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>

Some projects that depend on python cryptography and pyelftools packages
fail to build even when debian packages are installed. However, the same
works just fine with pip packages for the same. Hence, lets move those
couple of debian packages to pip packages instead.

Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>

This change is optional and changes nothing functionally. However, it
makes it more easier to understand the steps. Instead of coping the
default config to the builddir as .config and then running olddefconfig,
one could just use BR2_DEFCONFIG and point it to the buildroot default
config and run defconfig step.

Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>

The generated config files are hard to manage. Use the minimal config
file format generated by savedefconfig instead.

The generated .config file must match the exact copy this change is
replacing with.

Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>

Jean-Philippe Brucker authored May 30, 2024 and Ryan Roberts committed Jun 17, 2024

SMMU_IDR1 is too restrictive to be used by Linux:
- StreamID size of 2 bits, means the SMMU can't support 16-bit PCI IDs
- Event queue and command queues have a max size of 1 and 9. Linux needs at
  least 64 entries:
  [    1.485702] arm-smmu-v3 2b400000.iommu: command queue size <= 64 entries not supported

Do the union of the current features and the default model features.

Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

test.py captures stdout/err from the FVP and dumps it to the test's
stdout. It was previously encoding as utf-8 at source but in some cases
an exception meant that stdout was remaining binary. Let's always
capture it in binary then unconditionally encode as utf-8 when we write
it to stdout. That way we should sidestep the write() error if an
exception had occured.

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

Previously, the fvp would display "libdbus-1.so.3: cannot open shared
object file: No such file or directory" during boot. This was caused by
libdbus being missing. Once added to the container, the fvp started
using dbus to setup audio and emitted more warnings due to libpulse
being missing, so lets add that too.

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

Olivier Deprez authored May 27, 2024 and Ryan Roberts committed Jun 14, 2024

FVP has separate controls for enabling RME at the PE level
(clusterX.rme_support_level=2) and for enabling RME at the system level
(bp.has_rme=1).
Moreover legacy TZC-400 DRAM checks must be disabled when RME is
enabled as DRAM access control is enforced by GPT. Leaving TZC-400
checks enabled might lead to misconfigurations and conflicts.
Thus, for RME configs clear the bp.secure_memory control.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>

Olivier Deprez authored May 14, 2024 and Ryan Roberts committed Jun 14, 2024

From TF-A v2.11 restore the ability to specify
ARM_ARCH_MAJOR/ARM_ARCH_MINOR from TF-A command line for the desired
architecture extension.
This was gated by the fix [1] now merged.
Note config files for arch extensions beyond v9.2 are not updated by
this change and deserve doing it at a later time.

[1] https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/25886



Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>

Olivier Deprez authored May 14, 2024 and Ryan Roberts committed Jun 14, 2024

Per TF-A v2.11 CTX_INCLUDE_MTE_REGS is renamed ENABLE_FEAT_MTE2.
Now Hafnium supports SME state save/restore, enable SME for the
secure world (aka disable SME EL3 traps).

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>

Olivier Deprez authored May 14, 2024 and Ryan Roberts committed Jun 14, 2024

From TF-A v2.11 Hafnium supports saving/restoring SME state on
normal/secure world switches.
Remove the fix disabling it in the 4 worlds config.

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>

Olivier Deprez authored May 27, 2024 and Ryan Roberts committed Jun 14, 2024

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>

Olivier Deprez authored May 14, 2024 and Ryan Roberts committed Jun 14, 2024

Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>

docker.io imposes rate limits on pulling images, so let's cache the base
image in the gitlab registry to avoid this problem.

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

Current strategy is that all official docs builds from main branch are
against the "latest" version in readthedocs. But we also want to build
docs in other branches in the CI to ensure that there are no build
errors.

In the latter case, readthedocs only discovers the new branches (and
therefore new "versions") when it does a git pull. So we must force it
to build a version it knows about (main) to force the git pull before
building the target branch. We ensure that the target branch remains
inactive so that the built documentation is thrown away - we only care
about the build result.

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

The pipeline can automatically build the docker images and run the self
tests in the resulting base-full image. If the builds and tests succeed,
and if the target branch is "main", the images are published to docker
hub under the "latest" tag. Works for both x86_64 and arm64.

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

Shrinkwrap requires pyyaml. When running inside the image, as it does on
the CI, we must ensure this package is available.

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

Enhance publish.sh to support choice of driver (either docker or
manifest-tool), much like build.sh. This will allow its use on CI, which
is running in a container and cannot therefore use docker.

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

This causes kaniko to cache layer meta data in the gitlab registry and
check for hits when building images. So if (parts of) the dockerfile is
the same between CI pipelines, the cache can be used to speed everything
up.

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

Previously, the base-full image contained the directory structure for
the FVP package, but all the files were missing. Experimentation
concluded that Kaniko was getting confused because it has already
untared the fvp package for the base-slim image. If I comment out
building that image, then base-full contains all the required files.

So let's work around that issue by providing `--cleanup` to Kaniko,
which will cause it to clean its self up at the end of each invocation
so as not to confuse future invocations.

With this in place, the base-slim image is now correct.

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

When running on the CI, we want to be able to cache packages for arches
other than the arch we are running on, so allow optional --arch to be
passed to the script.

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

When building images on CI, we need to use Kaniko, since docker doesn't
work when running inside docker. So let's enhance the script to allow
the user to specify the driver. While we are at it, also allow the user
to specify the registry, since that will be needed for CI too, to store
temporary images. Additionally, ensure the script runs under sh, since
bash is not available in the kaniko container image.

For some reason `uname -p` returns "unknown" on CI runners, so let's
switch to the more standard `uname -m` instead.

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

build.sh previously downloaded the toolchains and fvp from the web
everytime it was invoked and deleted them when finished. This is
expensive, but worse, on the CI, wget is not available in the container
we must use to build the image.

So let's store the packages in a separate `assets` subdirectory, and
first check if what we need is there before downloading it. Additionally
don't delete them when finished. Locally, this avoids subsequent
invocations needing to download the packages. On the CI, we can cache
the directory so that subsequent pipelines are faster.

Finally add a special version, `none`, which if specified, syncs the
package cache but exits without actually building any images. This is
useful to enable separating the process of populating the cache on CI.

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

This format can be consumed by gitlab CI. While at it, exit with
non-zero exit code if any tests fail.

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

When running on a system with enough RAM and multiple CPUs, we can do
multiple FVP runs in parallel to save text execution time. This is
useful for the CI. A new option, `--fvpjobs` is added to specify the
maximum number of parallel instances. When 1 (the default), shrinkwrap
continues to output directly to the console as before. When >1, the
entire output of each run is captured then dumpped to stdout out
atomically.

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

To make test.py more suitable for use in CI, let's do a better job of
standardising the test names using type, config and overlay. And for run
tests, let's add a tag to identify the run configuration, since we often
run the same build in different configs.

By reflecting this hierachy in the test list, we also fix a previous
problem where the same build configuraiton was passed to Shrinkwrap
multiple times, so this should speed up the test run.

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

GitLab CI runners can only access git repos using the https protocol, so
update the bootwrapper URL suitably.

Additionally make the assets directory more friendly for caching by
ensuring only generated files that we want to cache are put there. So
move the script itself up a level, and make the build directory a
sibling - if building fails, we would not want to accidentally cache
that directory.

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

runtime: Ensure container gets cleaned up on shutdown

See merge request !45

Recent refactoring to simplify the Runtime class inadvertantly removed
the cleanup code. As a result, a container would not be stopped and
removed when shrinkwrap exits but would linger, using system resources.

Fix that by reintroducing the cleanup code.

Fixes: 1db05f5a ("runtime: replace modal stack with singleton")
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

build: Fix output to logfile

See merge request !44

Log files are per-script fragment and are named based on the component
to which they are associated. Until commit 7be0dacf ("build: Split
per-component artifact copy step"), there was at most, 1 script fragment
associated with each component, so this all worked as intended. But that
commit changed the "copy" script fragment to be per-component instead of
global. This meant that there were multiple log files with the same name
and the latter ones overwrote the former ones.

Fix this by introducing a per-component log file number, which is
appended to the log file name. It starts at 0 and increments for each
script fragment that is bound to a component.

Fixes: 7be0dacf ("build: Split per-component artifact copy step")
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

When running with Python 3.12, the following warnings are emitted. Let's
fix them.

utils/config.py:240: SyntaxWarning: invalid escape sequence '\$'
utils/config.py:241: SyntaxWarning: invalid escape sequence '\$'
utils/config.py:242: SyntaxWarning: invalid escape sequence '\{'
utils/config.py:245: SyntaxWarning: invalid escape sequence '\}'

Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>

build: Fix --no-sync with no arguments

See merge request !42

Add support for GIT over SSH

See merge request !41

This allows GIT over SSH to work, including when using a container
runtime.

* If the user already has an ssh-agent process running (indicated
  by the SSH_AUTH_SOCK environment variable being set), map this socket
  into the container.

* If the user does not have an ssh-agent process running, or wishes to
  expose only a subset of their keys to the container, a new --ssh-agent
  option causes shrinkwrap to start an ssh-agent subprocess, and to add
  specified keys. As above, the socket on which the ssh-agent is
  listening is mapped into the container.

Signed-off-by: Gareth Stockwell <gareth.stockwell@arm.com>

Signed-off-by: Gareth Stockwell <gareth.stockwell@arm.com>

Signed-off-by: Gareth Stockwell <gareth.stockwell@arm.com>