Buildroot Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Charles Hardin <ckhardin@gmail.com>
To: buildroot@buildroot.org
Cc: Etienne Carriere <etienne.carriere@foss.st.com>,
	Charles Hardin <ckhardin@gmail.com>
Subject: [Buildroot] [PATCH 1/1] boot/optee-os: add suppot to build with the ftpm application
Date: Wed, 28 Oct 2026 14:37:30 -0700	[thread overview]
Message-ID: <20261028213730.3132-1-ckhardin@gmail.com> (raw)

The ftpm is part of the trusted execution environment and so add in
build steps and configuration to enable the additional image. This
following the TPM 2.0 microsoft extensions and compatibility. So,
patching this into the optee configuration since it needs the sdk
and other tools to directly build the ftpm application.

Signed-off-by: Charles Hardin <ckhardin@gmail.com>
---
 boot/optee-os/Config.in     | 29 ++++++++++++++++++
 boot/optee-os/optee-os.hash |  2 ++
 boot/optee-os/optee-os.mk   | 59 ++++++++++++++++++++++++++++++++++++-
 3 files changed, 89 insertions(+), 1 deletion(-)

diff --git a/boot/optee-os/Config.in b/boot/optee-os/Config.in
index af08375b9a..566b56064d 100644
--- a/boot/optee-os/Config.in
+++ b/boot/optee-os/Config.in
@@ -131,6 +131,35 @@ config BR2_TARGET_OPTEE_OS_SDK
 	  kit for building OP-TEE trusted application images. It is
 	  installed in the staging directory /lib/optee.
 
+config BR2_TARGET_OPTEE_OS_FTPM
+	bool "Build fTPM (Firmware TPM 2.0) TA"
+	select BR2_TARGET_OPTEE_OS_SDK
+	help
+	  Build the Microsoft TPM 2.0 Reference Implementation (fTPM)
+	  as an OP-TEE Trusted Application.
+
+	  UUID: bc50d971-d4c9-42c4-82cb-343fb7f37896
+
+if BR2_TARGET_OPTEE_OS_FTPM
+
+config BR2_TARGET_OPTEE_OS_FTPM_EARLY_TA
+	bool "Embed fTPM as Early TA in OP-TEE core"
+	default y
+	help
+	  Embeds the fTPM TA directly into the OP-TEE OS binary (tee.bin)
+	  as an early TA. Required for pre-userspace TPM operations such
+	  as U-Boot verified boot and Linux IMA before tee-supplicant runs.
+
+config BR2_TARGET_OPTEE_OS_FTPM_VERSION
+	string "optee_ftpm version"
+	default "4.10.0"
+
+config BR2_TARGET_OPTEE_OS_FTPM_MS_REF_VERSION
+	string "ms-tpm-20-ref commit"
+	default "98b60a44aba79b15fcce1c0d1e46cf5918400f6a"
+
+endif
+
 config BR2_TARGET_OPTEE_OS_SERVICES
 	bool "Build service TAs and libs"
 	default y
diff --git a/boot/optee-os/optee-os.hash b/boot/optee-os/optee-os.hash
index 3db5c85cf1..7788955380 100644
--- a/boot/optee-os/optee-os.hash
+++ b/boot/optee-os/optee-os.hash
@@ -1,3 +1,5 @@
 # Locally computed
 sha256  9400e16c45bfa45f15585b2c933b86c449e7de05def0ecaaa62a4f38973a3a45  optee-os-4.9.0.tar.gz
+sha256  907fd49dc9db97fc16c8e4309e8e17109a044711d053135f21690dadaf50908c  optee_ftpm-4.10.0.tar.gz
+sha256  1c7136f2e6270b10da188163369f2ed9fae68e404c0c8169b317b5eba667287c  ms-tpm-20-ref-98b60a44aba79b15fcce1c0d1e46cf5918400f6a.tar.gz
 sha256  1247ee90858f4037b6cac63cbffddfed435d0d73c631b37d78c1e6e6ab3e5d1a  LICENSE
diff --git a/boot/optee-os/optee-os.mk b/boot/optee-os/optee-os.mk
index 38faf8bff7..ccc63f6650 100644
--- a/boot/optee-os/optee-os.mk
+++ b/boot/optee-os/optee-os.mk
@@ -141,15 +141,72 @@ define OPTEE_OS_INSTALL_STAGING_CMDS
 endef
 endif # BR2_TARGET_OPTEE_OS_SDK
 
+ifeq ($(BR2_TARGET_OPTEE_OS_FTPM),y)
+OPTEE_OS_FTPM_UUID = bc50d971-d4c9-42c4-82cb-343fb7f37896
+OPTEE_OS_FTPM_VERSION = $(call qstrip,$(BR2_TARGET_OPTEE_OS_FTPM_VERSION))
+OPTEE_OS_FTPM_MS_REF_VERSION = $(call qstrip,$(BR2_TARGET_OPTEE_OS_FTPM_MS_REF_VERSION))
+
+OPTEE_OS_FTPM_SITE = $(call github,OP-TEE,optee_ftpm,$(OPTEE_OS_FTPM_VERSION))
+OPTEE_OS_FTPM_SOURCE = optee_ftpm-$(OPTEE_OS_FTPM_VERSION).tar.gz
+OPTEE_OS_EXTRA_DOWNLOADS += $(OPTEE_OS_FTPM_SITE)/$(OPTEE_OS_FTPM_SOURCE)
+
+OPTEE_OS_MS_REF_SITE = $(call github,microsoft,ms-tpm-20-ref,$(OPTEE_OS_FTPM_MS_REF_VERSION))
+OPTEE_OS_MS_REF_SOURCE = ms-tpm-20-ref-$(OPTEE_OS_FTPM_MS_REF_VERSION).tar.gz
+OPTEE_OS_EXTRA_DOWNLOADS += $(OPTEE_OS_MS_REF_SITE)/$(OPTEE_OS_MS_REF_SOURCE)
+
+OPTEE_OS_FTPM_DIR = $(@D)/optee_ftpm
+OPTEE_OS_MS_REF_DIR = $(@D)/ms-tpm-20-ref
+OPTEE_OS_FTPM_OUT = $(OPTEE_OS_FTPM_DIR)/out
+
+define OPTEE_OS_EXTRACT_FTPM
+	mkdir -p $(OPTEE_OS_FTPM_DIR)
+	$(call suitable-extractor,$(OPTEE_OS_DL_DIR)/$(OPTEE_OS_FTPM_SOURCE)) $(OPTEE_OS_DL_DIR)/$(OPTEE_OS_FTPM_SOURCE) \
+	| $(TAR) --strip-components=1 -C $(OPTEE_OS_FTPM_DIR) $(TAR_OPTIONS) -
+	mkdir -p $(OPTEE_OS_MS_REF_DIR)
+	$(call suitable-extractor,$(OPTEE_OS_DL_DIR)/$(OPTEE_OS_MS_REF_SOURCE)) $(OPTEE_OS_DL_DIR)/$(OPTEE_OS_MS_REF_SOURCE) \
+	| $(TAR) --strip-components=1 -C $(OPTEE_OS_MS_REF_DIR) $(TAR_OPTIONS) -
+endef
+OPTEE_OS_POST_EXTRACT_HOOKS += OPTEE_OS_EXTRACT_FTPM
+
+OPTEE_OS_FTPM_OPTS = \
+	TA_DEV_KIT_DIR=$(@D)/$(OPTEE_OS_LOCAL_SDK) \
+	CFG_MS_TPM_20_REF=$(OPTEE_OS_MS_REF_DIR) \
+	CROSS_COMPILE="$(TARGET_CROSS)" \
+	O=$(OPTEE_OS_FTPM_OUT)
+
+ifeq ($(BR2_aarch64),y)
+OPTEE_OS_FTPM_OPTS += CFG_ARM64_ta_arm64=y
+else
+OPTEE_OS_FTPM_OPTS += CFG_ARM32_ta_arm32=y
+endif
+
+ifeq ($(BR2_TARGET_OPTEE_OS_FTPM_EARLY_TA),y)
+OPTEE_OS_MAKE_OPTS += CFG_EARLY_TA=y EARLY_TA_PATHS=$(OPTEE_OS_FTPM_OUT)/$(OPTEE_OS_FTPM_UUID).stripped.elf
+endif
+
+define OPTEE_OS_BUILD_FTPM
+	$(TARGET_MAKE_ENV) $(MAKE) -C $(OPTEE_OS_FTPM_DIR) $(OPTEE_OS_FTPM_OPTS)
+endef
+define OPTEE_OS_INSTALL_IMAGES_FTPM
+	mkdir -p $(BINARIES_DIR)/optee
+	cp -dpf $(OPTEE_OS_FTPM_OUT)/$(OPTEE_OS_FTPM_UUID).ta \
+		$(BINARIES_DIR)/optee/
+	cp -dpf $(OPTEE_OS_FTPM_OUT)/$(OPTEE_OS_FTPM_UUID).stripped.elf \
+		$(BINARIES_DIR)/optee/
+endef
+endif # BR2_TARGET_OPTEE_OS_FTPM
+
 define OPTEE_OS_BUILD_CMDS
 	$(if $(OPTEE_OS_CUSTOM_DTS_PATH),
 		cp -f $(OPTEE_OS_CUSTOM_DTS_PATH) $(@D)/core/arch/arm/dts/
 	)
-	$(OPTEE_OS_BUILD_CORE)
 	$(OPTEE_OS_BUILD_SDK)
+	$(OPTEE_OS_BUILD_FTPM)
+	$(OPTEE_OS_BUILD_CORE)
 endef
 
 define OPTEE_OS_INSTALL_IMAGES_CMDS
+	$(OPTEE_OS_INSTALL_IMAGES_FTPM)
 	$(OPTEE_OS_INSTALL_IMAGES_CORE)
 	$(OPTEE_OS_INSTALL_IMAGES_SERVICES)
 endef
-- 
2.50.1 (Apple Git-155)

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

                 reply	other threads:[~2026-10-28 21:37 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261028213730.3132-1-ckhardin@gmail.com \
    --to=ckhardin@gmail.com \
    --cc=buildroot@buildroot.org \
    --cc=etienne.carriere@foss.st.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox