ci: notify_maintainers.py: filter out comment authors

This is a small bug fix for the notify_maintainers.py script which
should not mention a user who has already been involved in the
discussion. Cu

ci: notify_maintainers.py: filter out comment authors

This is a small bug fix for the notify_maintainers.py script which
should not mention a user who has already been involved in the
discussion. Currently, it filters out users that have explicitly been
mentioned (via '@user'), either by the CI bot or by a real user. But
it does not consider the comment authors. This is a mistake. Update
the code accordingly.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ci: notify_maintainers: do not print message without any handle

In case all handles have been filtered out from handles_to_mention, do
not print any message at all. This avoids posting a useless "FY

ci: notify_maintainers: do not print message without any handle

In case all handles have been filtered out from handles_to_mention, do
not print any message at all. This avoids posting a useless "FYI
<nothing>" comment.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ci: notify_maintainers: simplify scripts and use actions/github-script

Attempting once more to fix a 403 error in the notify_maintainers job.
Simplify the notify_maintainers.py script which now assu

ci: notify_maintainers: simplify scripts and use actions/github-script

Attempting once more to fix a 403 error in the notify_maintainers job.
Simplify the notify_maintainers.py script which now assumes the GitHub
environment with parameters passed as environment variables only and
make it output the message to stdout. It is then the responsibility of
the notify_maintainers job to post it, via the actions/github-script
action. In the tests I performed, the comment was successfully posted
by "github-actions (bot)".

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ci: scripts/notify_maintainers.py: use non-deprecated API

Supplying a token to the GitHub class constructor is deprecated. Use an
Auth object instead.

Signed-off-by: Jerome Forissier <jerome.foriss

ci: scripts/notify_maintainers.py: use non-deprecated API

Supplying a token to the GitHub class constructor is deprecated. Use an
Auth object instead.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ci: scripts/notify_maintainers.py: improve debug traces

Print the message before sending it via the GitHub API so that it
appears in the logs in case pr.create_issue_comment() raises an
exception.

ci: scripts/notify_maintainers.py: improve debug traces

Print the message before sending it via the GitHub API so that it
appears in the logs in case pr.create_issue_comment() raises an
exception.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ci: scripts/notify_maintainers.py: fix GitHub handle regexp

When looking for GitHub handles in the PR comments (i.e., people
already mentioned), include the hyphen character so that handles of the
f

ci: scripts/notify_maintainers.py: fix GitHub handle regexp

When looking for GitHub handles in the PR comments (i.e., people
already mentioned), include the hyphen character so that handles of the
form '@foo-bar' are properly matched.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

ci: scripts/notify_maintainers.py: fix undefined variable error

Fix error:

File "scripts/notify_maintainers.py", line 132, in main
" ".join(f"@{h}" for h in new_handles))

ci: scripts/notify_maintainers.py: fix undefined variable error

Fix error:

File "scripts/notify_maintainers.py", line 132, in main
" ".join(f"@{h}" for h in new_handles))
^^^^^^^^^^^
UnboundLocalError: cannot access local variable 'new_handles' where it
is not associated with a value

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

scripts/gen_ldelf_hex.py: account for true memsz in last load segment mapping

The pad_size array is used to compute code/data/load mapping sizes for
ldelf by measuring the gaps after each PT_LOAD se

scripts/gen_ldelf_hex.py: account for true memsz in last load segment mapping

The pad_size array is used to compute code/data/load mapping sizes for
ldelf by measuring the gaps after each PT_LOAD segment. The last entry
was hardcoded to 0, effectively ignoring the final segment’s
(p_memsz - p_filesz) - i.e. the BSS portion that exists in memory but
not in the file.

As a result, the RW mapping for ldelf was undersized: the zero-filled
area of the last PT_LOAD was not reserved, which could lead to writes
past the mapped region.

Signed-off-by: Aleksandr Iashchenko <aleksandr.iashchenko@linutronix.de>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

ci: mention reviewers/maintainers from MAINTAINERS

Introduce a new Python script: notify_maintainers.py and run it in CI
as part of a new job. When invoked in the context of a pull request
against t

ci: mention reviewers/maintainers from MAINTAINERS

Introduce a new Python script: notify_maintainers.py and run it in CI
as part of a new job. When invoked in the context of a pull request
against the OP-TEE OS official project, it invokes get_maintainer.py
to find out the GitHub handles of the people to whom the change in the
PR is relevant. It then posts a comment so that these people may be
notified via email. People are mentioned only once per PR (they
normally receive subsequent messages automatically). The PR author,
assignees and requested reviewers (if any) are skipped since they are
already notified, as well as the default maintainers ("THE REST") who
are assumed to receive all PRs. The format of the comment is:

github-actions (bot) commented ...

FYI <handle1> <handle2>...

Note: Subsystem/platform maintainers who have their GitHub handle in
MAINTAINERS and who already "watch" the project will receive two emails
upon creation of a PR that touches their area of expertise: one when
the PR is created, and one shortly after when the script runs and the
GitHub bot tags them in a comment. Hopefully it is only a minor
inconvenience.

Note 2: The script was written with the help of generative AI. It was
reviewed, tested and modified by me.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Reviewed-by: Rouven Czerwinski <rouven.czerwinski@linaro.org>

show more ...

ci: rework (host cleanup, matrix builds, Rust enabled, cancel on push)

This is a big cleanup of the CI file:

- Enable Rust again, effectively reverting commit 6c9dd3eb9fec ("ci:
disable Rust glob

ci: rework (host cleanup, matrix builds, Rust enabled, cancel on push)

This is a big cleanup of the CI file:

- Enable Rust again, effectively reverting commit 6c9dd3eb9fec ("ci:
disable Rust globally"). In order to do so, a "host cleanup" script
is introduced (scripts/ci-host-cleanup.sh). It is run by the QEMU
jobs before launching the CI Docker image. The script removes a bunch
of files that are not needed (~ 24 GB), thus leaving more space for
the Docker image to grow as the build proceeds. The script is mostly
copied from the teaclave-trustzone-sdk CI [1].
- Make the platform builds faster and easier to monitor by using the
matrix keyword to launch parallel jobs. Each platform build job now
has the target architecture and platforms clearly specified so it's
easy to see if a platform is broken from the GitHub actions page
without looking at the logs. This also reduces code duplication.
- The ci-cancel.yml workflow is replaced with the cancel-in-progress
setting in the concurrency block of the CI the workflow. This is
simpler and avoids the "Cancel obsolete CI" entries in the project's
actions log.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Link: https://github.com/apache/teaclave-trustzone-sdk/blob/f67a5ddcde3e/.github/workflows/reuse_test_in_optee_repo.yml#L40-L67 [1]
Acked-by: Yuan Zhuang <yuanz@apache.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

tree-wide: use /usr/bin/env bash in bash scripts

Some distributions don't provide bash inside of /bin, increase
compatibility by using env to resolve the correct path at runtime.
Fixes running the s

tree-wide: use /usr/bin/env bash in bash scripts

Some distributions don't provide bash inside of /bin, increase
compatibility by using env to resolve the correct path at runtime.
Fixes running the scripts on my NixOS systems.

Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

scripts: sign_rproc_fw: Add the support of encrypted signature key

Add possibility to provide a passphrase for an encrypted PEM key
used for the signature.

The passphrase is provided with the optio

scripts: sign_rproc_fw: Add the support of encrypted signature key

Add possibility to provide a passphrase for an encrypted PEM key
used for the signature.

The passphrase is provided with the optional --key_pwd argument.

usage:
--key_pwd="my password"

Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

sign_encrypt.py: Fix typo from 'Unkown' to 'Unknown'

The value of enc_algo_name and flags_name was set to 'Unkown',
should be 'Unknown' instead.

Signed-off-by: Aristo Chen <aristo.chen@canonical.co

sign_encrypt.py: Fix typo from 'Unkown' to 'Unknown'

The value of enc_algo_name and flags_name was set to 'Unkown',
should be 'Unknown' instead.

Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

sign_encrypt.py: fix an error in the verify command with '--enc_key'.

Fix a bug where the verify command requires '--enc_key' option for
encrypted TA, but an error occurs when the option is used.

S

sign_encrypt.py: fix an error in the verify command with '--enc_key'.

Fix a bug where the verify command requires '--enc_key' option for
encrypted TA, but an error occurs when the option is used.

Signed-off-by: Sungmin Han <sungminhan@telechips.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

sign_encrypt.py: fix incorrect tag value output in the display command.

Fix a bug where the display command shows incorrect tag value when the
input is an encrypted TA.

Signed-off-by: Sungmin Han <

sign_encrypt.py: fix incorrect tag value output in the display command.

Fix a bug where the display command shows incorrect tag value when the
input is an encrypted TA.

Signed-off-by: Sungmin Han <sungminhan@telechips.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

pta: veraison_attestation: integrate Veraison remote attestation PTA

Copy remote attestation PTA functionality from the repository:
https://github.com/iisec-suzaki/optee-ra (commit: 80ca8ef), and ma

pta: veraison_attestation: integrate Veraison remote attestation PTA

Copy remote attestation PTA functionality from the repository:
https://github.com/iisec-suzaki/optee-ra (commit: 80ca8ef), and make
the following adjustments for integration:

- Add build configuration for remote attestation PTA by introducing
the CFG_VERAISON_ATTESTATION_PTA option to align with the new naming
convention.
- Replace the custom base64 implementation with the base64 library
added in PR OP-TEE#7007.
- Update QCBOR integration by removing custom QCBOR files and using
the standard library, adjusting paths as necessary.
- Apply region validation improvements introduced in PR OP-TEE#6195.
- Update API calls in sign.c to align with libmbedtls changes from
PR OP-TEE#6151.
- Calculate the required buffer size at runtime to minimize memory
allocation.
- Refactor code to improve readability and maintainability.
- Add SPDX license identifier (BSD-2-Clause) and copyright notice.

Signed-off-by: Yuichi Sugiyama <yuichis@ricsec.co.jp>
Reviewed-by: Thomas Fossati <thomas.fossati@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

sign_encrypt.py: fix typo in stitch usage message

Fix typo in stitch usage message.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jerome Forissier <jerome.forissier@li

sign_encrypt.py: fix typo in stitch usage message

Fix typo in stitch usage message.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

scripts: fix invalid escape sequence

A backslash-character pair that is not a valid
escape sequence is generating a SyntaxWarning in
Python 3.12 and could generate a SyntaxError in a
future version.

scripts: fix invalid escape sequence

A backslash-character pair that is not a valid
escape sequence is generating a SyntaxWarning in
Python 3.12 and could generate a SyntaxError in a
future version.

Use a raw string to avoid the escape.

Signed-off-by: Shen Jiamin <shen_jiamin@comp.nus.edu.sg>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

ftrace: ftrace_format.py: display seconds

When the time spent in a function is 1 second or more, display it as
seconds not milliseconds in order to keep the output nicely aligned.

Signed-off-by: Je

ftrace: ftrace_format.py: display seconds

When the time spent in a function is 1 second or more, display it as
seconds not milliseconds in order to keep the output nicely aligned.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

scripts: checkpatch: fix word splitting in the command

The following would fail with Zsh instead of Bash :
$ source ./scripts/checkpatch_inc.sh
$ checkpatch HEAD
Unknown option: typedefsfile typedef

scripts: checkpatch: fix word splitting in the command

The following would fail with Zsh instead of Bash :
$ source ./scripts/checkpatch_inc.sh
$ checkpatch HEAD
Unknown option: typedefsfile typedefs.checkpatch
Usage: .../scripts/checkpatch.pl [OPTION]... [FILE]

By setting xtrace in the _checkpatch() function, we can see the built
command is interpreted differently depending on the shell:
$CHECKPATCH $CHECKPATCH_OPT $typedefs_opt -
In Zsh:
/scripts/checkpatch.pl '--typedefsfile typedefs.checkpatch' -
In Bash:
/scripts/checkpatch.pl --typedefsfile typedefs.checkpatch -

Bash differs from Zsh when it comes to word splitting for unquoted
parameters expansions.
One solution is to use `eval` to execute the built command.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: print current guest ID in logs

If CFG_NS_VIRTUALIZATION is enabled include the current guest ID on each
log line. A number is added before the core number identifying the
currently set guest I

core: print current guest ID in logs

If CFG_NS_VIRTUALIZATION is enabled include the current guest ID on each
log line. A number is added before the core number identifying the
currently set guest ID, for example:
D/TC:2 0 0 call_initcalls:40 level 1 teecore_init_pub_ram()

Where the "2" indicates that this is done with guest ID 2 active.

Update the symbolize.py script accordingly to recognize and ignore an
eventual guest ID in a log entry.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

scripts: Add script to support Language Server Protocol (LSP)

The Language Server Protocol (LSP) is a standard protocol used by many
text editors and integrated development environments (IDEs) to en

scripts: Add script to support Language Server Protocol (LSP)

The Language Server Protocol (LSP) is a standard protocol used by many
text editors and integrated development environments (IDEs) to enable
advanced language features such as code completion, hover information,
and diagnostics.

This commit introduces a script that simplifies the generation of LSP
configuration JSON files. These JSON files describe how source files are
compiled and linked together for use with LSP-enabled tools. The script
is adapted from U-Boot and customized to work with the *.cmd files used
by OP-TEE, making it easier to harness the power of LSP for development
and code analysis.

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

scripts/ts_bin_to_c.py: look for ta_head symbol

Legacy TAs have their TA header in a .ta_head section of the TA binary.
However, in commits to follow the TA header will instead be located in
the sym

scripts/ts_bin_to_c.py: look for ta_head symbol

Legacy TAs have their TA header in a .ta_head section of the TA binary.
However, in commits to follow the TA header will instead be located in
the symbol ta_head located somewhere inside the ELF binary. So update
the ts_bin_to_c.py script to support the updated format.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

scripts: sign_rproc_fw: clean up unused TLV method

Remove the __len__ method of the TLV class. It is not being
used and uses an undefined variable TLV_INFO_SIZE.
This method is a remnant of code tha

scripts: sign_rproc_fw: clean up unused TLV method

Remove the __len__ method of the TLV class. It is not being
used and uses an undefined variable TLV_INFO_SIZE.
This method is a remnant of code that was removed during upstream
reviews.

Fixes: e8ef53536bda ("scripts: add remote processor firmware signature tool")
Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

scripts: add remote processor firmware signature tool

Add a script that signs one or several remote processor ELF firmware that
will be authenticated by the remoteproc TA.

This tool adds a binary h

scripts: add remote processor firmware signature tool

Add a script that signs one or several remote processor ELF firmware that
will be authenticated by the remoteproc TA.

This tool adds a binary header, a signature and a TLV list.

The header contains a magic number, a version number and
the size of the different blobs (signature, images, TLV list blobs).

The signature contains a signature authenticating the
header blob hash and the TLV blob hash.

The TLV blob contains a list of data formatted as Type/Length/Value
fields. It contains information for the remoteproc TA and
the remoteproc platform specific PTA.

The TLV types from 0 to 0x00010000 are predefined information used by
the remoteproc TA:
- algorithm used for signature
- algorithm used for computing segment's hash
- number of images to load
- types of the images to load
- sizes of the images to load
- a copy of the elf segment tables with associated hash

the TLV types from 0x00010000 to 0x00020000 contains information
transferred to the remoteproc platform PTA.

Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...