Android + OP-TEE compile error

Products Support HiKey
#21

Hi @vchong

  1. No problems now. My boot.img is fine
  2. Ran xtest as root
    adb root
    adb remount
    adb shell
    xtest
    This is the sequence of cmds
  3. xtest result is here for your reference : http://pastebin.com/V6JAGuSA

For monitor, it was my mistake. I used a DVI monitor and connected hikey with HDMI-DVI cable and there was no display. Now , I am using another monitor having HDMI input and display is fine now.
I think , the key point here is to use direct HDMI monitor

Yep , now I can work on my TA application. Thanks for your quick support

Now , a quick question :
Dont I need optee_os/kernel src code, to build my TA ?
My question arises in the context that , suppose, I give my board to my colleague so that he can verify his TA.
Does he need to have complete stack ( AOSP+OPTEE) like I have ?

Isnt there any on-board security check between TA and optee_os/kernel before TA loads and executes ?
If so , anybody can load their own TA on the board and run it. Isnt this a security loop-hole ?

#22

Is there any command only to “clean and recompile” kernel ?

I just want to change below files
hi6220-hikey.dtb
kernel
boot.img
boot_fat.uefi.img

I am trying this command, but want to make sure
→ make -j12 TARGET_BUILD_KERNEL=true bootimage

#23

Please provide the output of ps -ef | grep tee.

To compile a TA, you need the TA dev kit, which is built as part of the optee_os build, and also libteec.so from the optee_client build. You don’t need the optee_os source code per se. See build_ta_helloworld_qemu.sh as a reference. Find libteec.so and the export-ta_arm64 dir in the ${ANDROID_PRODUCT_OUT} dir and give it to your colleague. Then he/she can build TAs outside the aosp tree using https://github.com/linaro-swg/hello_world/blob/master/README.md or https://github.com/linaro-swg/hello_world/blob/master/build_ta_helloworld_qemu.sh as a reference. Adjust paths for TA_DEV_KIT_DIR and TEEC_EXPORT accordingly, and be sure to use an aosp toolchain instead!

optee_os will check the TA signature before loading and executing, but since this is just a reference implementation, the key and signature are known. Using and securing a key is platform specific so you should implement it specific to your hardware.

I think make -j12 TARGET_BUILD_KERNEL=true bootimage will rebuild everything you listed except boot_fat.uefi.img. Not sure if make -j12 TARGET_BUILD_KERNEL=true TARGET_BOOTIMAGE_USE_FAT=true bootimage will help or not. Please try it and check the date to see if the files are updated. If not, it shouldn’t take too long to rerun the full build anyway since most of the other stuffs haven’t changed.

#24

Forgot to mention that your colleague will need the header files from /path/to/optee_client/out/export as well.

#25

output as you asked :

hikey:/ # ps | grep tee
root 1862 1 7456 2136 optee_supp 0000000000 S /system/bin/tee-supplicant

ps is neither taking ‘e’ not ‘f’

Now , my next part is communicate with my spi device through TEE.
For that , I am trying to build a driver , which should execute in TEE and communicate with my device.
I will talk to my driver from NW binary ( similar to hello world program )

Is it possible to add new drivers to TEE-OS or should I need to modify the existing code here: optee/optee_os/core/drivers

Is there any reference material to add new drivers to OPTEE ?
Or can you show me right forum to clarify my doubts ?

Thanks

#26

Hi @vchong

I am facing compile errors for Jack server while building AOSP 7 with OPTEE.

I have followed below link which you mentioned in your pervious posts and got compile error at step 3.8

below are the errors

[ 30% 14663/48104] Ensure Jack server is installed and started
FAILED: /bin/bash -c “(prebuilts/sdk/tools/jack-admin install-server prebuilts/sdk/tools/jack-launcher.jar prebuilts/sdk/tools/jack-server-4.8.ALPHA.jar 2>&1 || (exit 0) ) && (JACK_SERVER_VM_ARGUMENTS=”-Dfile.encoding=UTF-8 -XX:+TieredCompilation" prebuilts/sdk/tools/jack-admin start-server 2>&1 || exit 0 ) && (prebuilts/sdk/tools/jack-admin update server prebuilts/sdk/tools/jack-server-4.8.ALPHA.jar 4.8.ALPHA 2>&1 || exit 0 ) && (prebuilts/sdk/tools/jack-admin update jack prebuilts/sdk/tools/jacks/jack-2.28.RELEASE.jar 2.28.RELEASE || exit 47; prebuilts/sdk/tools/jack-admin update jack prebuilts/sdk/tools/jacks/jack-3.36.CANDIDATE.jar 3.36.CANDIDATE || exit 47; prebuilts/sdk/tools/jack-admin update jack prebuilts/sdk/tools/jacks/jack-4.7.BETA.jar 4.7.BETA || exit 47 )"
Jack server already installed in “/home/svaddi/.jack-server”
Communication error with Jack server (58), try ‘jack-diagnose’ or see Jack server log
Failed to contact Jack server: Problem reading /home/svaddi/.jack-server/client.pem. Try ‘jack-diagnose’
Failed to contact Jack server: Problem reading /home/svaddi/.jack-server/client.pem. Try ‘jack-diagnose’
[ 30% 14663/48104] host Java: conscrypt-host (out/host/common/obj/JAVA_LIBRARIES/conscrypt-host_intermediates/classes)
warning: [options] bootstrap class path not set in conjunction with -source 1.7
external/conscrypt/src/openjdk/java/org/conscrypt/Platform.java:45: warning: AlgorithmId is internal proprietary API and may be removed in a future release

can you please support ? (Note : I am using 16GB RAM PC and Java version is 1.8)

Thanks in advance,
Raj.

#27

@deepakmnvl
Ok, thanks! The xtest errors are not really problems with OP-TEE but rather related to selinux. In any case, it’s a known issue and currently being worked on.

Regarding spi driver issue, seems like it’s already answered in https://github.com/OP-TEE/optee_os/issues/1461.

@Rajasekhara_Reddy
What does the Jack server log say? Did you try running jack-diagnose as recommended? Did you make any changes to the Jack server? It usually just runs without any issue or modifications required. Have you tried deleting /home/svaddi/.jack-server and /home/svaddi/.jack-settings and build again?

#28

@vchong,

I didn’t change anything for jack server and tried all the above suggestions mentioned by you already but didn’t worked out :frowning:

By searching in google i have found some solution and tried, it was worked out i.e. kill server and start server.

Now i will flash my image files in Hikey board and check.

If any problem comes will let you know.

Thanks,
Raj.

#29

@Rajasekhara_Reddy As mentioned in one of the posts above, if you’re working on a shared server where there are multiple other users/accounts trying to build aosp, you’ll either have to kill the instance started by another user as you did, or use different ports per user to avoid conflicts. Anyway, it’s good that you got your build to run successfully.

#30

Hi @vchong
I believe optee os resides in fip.bin and for any changes in core os part, fip.bin should be flashed.
Now, I have made some changes in core and gave make command. Boot.img and other images were generated but fip.bin remained old.

Is there any different way to compile it

Thanks

#31

See https://github.com/linaro-swg/optee_android_manifest/tree/hikey-n-4.9#37-build-the-booloader-firmware-fipbin.

#32

OOPS , thats obvious. This totally missed as I ran this step only once initially. Thanks

Also , is it possible to use uart0 as uart output of hikey ?
Since , my SPI device is connected on LS expansion, uart3 is not accessible directly.

I see this in hikey user guide :
The HiKey board also has an option for a Debug UART Header. This is normally used by
the first stage bootloader developers, and is connected to the UART0 port of the SoC. This
is available if a 2x2 male header is installed at J801.

This is still possible now ?

EDIT:
also ,
i tried using below command :
make -j12 TARGET_BUILD_KERNEL=true TARGET_BOOTIMAGE_USE_FAT=true CFG_CONSOLE_UART=0

I couldnt see any log on my uart0.
My setup is “serial to uart convertor” and putty.exe with speed 115200.
connections are at 2x2 male header installed at J801

Thanks

#33

That’s weird. You should at least see the OP-TEE logs on uart0. In any case, please try below.

In device/linaro/hikey/uefi-tools/platforms.config, under the [hikey] node, uncomment the 3 lines required to use UART0. Then rebuild fip.bin.

In device/linaro/hikey/bootloader/EFI/BOOT/grub.cfg, line 6, change both ttyFIQ0 to ttyAMA0 and rebuild the image.

#34

hey @vchong ,
above solution also didnt work.

I am getting a lot of garbage like below :
▒▒▒▒▒▒▒i{▒▒▒l▒▒▒▒▒▒▒E▒▒▒▒▒▒==▒▒▒▒333333▒▒▒▒9=▒▒▒▒▒▒▒▒333333▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒i{▒▒▒H▒▒▒▒▒▒▒E▒▒▒▒▒▒▒▒-#-▒▒▒▒333333▒▒▒▒▒▒▒▒▒▒▒▒▒▒333333▒▒▒▒▒=

Am connecting pins 2,3,4 only , from hikey board to PC ( via convertor )
I dont know if there are any voltage differences ( 1.8 , 3.3 etc )
Do you have any idea of this ?

Otherwise , for using uart3, I will try to tap out wires from LS connector by soldering.
Can you tell me which pins should I use ?

Thanks

#35

Did you try swapping tx and rx? Also verify 115200 8N1 and no flow control for your settings? What kind of cable are you using? It has to be 1.8v!

In any case, please refer to http://wiki.lemaker.org/HiKey(LeMaker_version):UART for pin numbers and other details. Note the warning to NOT connect J801-01 to VCC, or else you might damage the board!

#36

Same result with uart3 too.

Am getting garbage , but a thing to note → when I connect uart out , it seems the booting is halted.
Android logo UI is not appearing and I am not getting adb shell

And it seems , even uart3 requires 1.8V connector. and seems my connector is not.
Is there any workaround for this ?

Can we get all these logs on logcat itself ?

PS: Meanwhile, I will scout for a compatible cable in the market

#37

when I connect uart out , it seems the booting is halted.
Android logo UI is not appearing and I am not getting adb shell

Not sure here. If it boots fine without the uart, then sounds like a bad connection somewhere.

Afaik all uarts are 1.8v. The usb adapter board (http://www.96boards.org/product/debug/) level shifts this to 3.3v so you can use a regular usb cable, but yes, it does block other connections so maybe tapping out is not a bad idea.

The effort to get these onto logcat was abandoned. You can refer to https://github.com/OP-TEE/optee_os/pull/810 for more details. At least one other user wants to try it.

You can check out the cable on https://github.com/OP-TEE/optee_os/pull/810 as well.

#38

HI @vchong
I already tried this ( https://github.com/OP-TEE/optee_os/pull/810 )
But , it didnt work.

So , regarding logs from uart , my HW team is looking into it to get a working cable.

My another query :
I am trying to access gpio pins of my spi board from OPTEE. Seems there is some differences in pin numbers between REE and TEE.
I am refering https://github.com/OP-TEE/optee_os/issues/944.

You gave addresses like this :
#define GPIO2_BASE 0xF8013000 //16-23

Can you share the date sheet containing these kinds of memory mapping info for lemaker hikey board ?

Thanks

#39

I already tried this ( https://github.com/OP-TEE/optee_os/pull/810)
But , it didnt work.

The patch is old and abandoned so it might require effort to get it to work again.

Can you share the date sheet containing these kinds of memory mapping info for lemaker hikey board ?

The data sheet is here: https://github.com/96boards/documentation/blob/master/ConsumerEdition/HiKey/HardwareDocs/Hi6220V100_Multi-Mode_Application_Processor_Function_Description.pdf. Section 5.1.2. The register addresses are here too: https://github.com/OP-TEE/optee_os/issues/944#issuecomment-238070973.

#40

Hello @vchong

I am facing one compilation issue in latest optee code (followed steps mentioned in https://github.com/linaro-swg/optee_android_manifest/tree/hikey-n-4.9 link and applied patches).

Please find below error.

[ 3% 1587/47715] build out/target/product/hikey/obj/ETC/sepolicy_intermediates/sepolicy
FAILED: /bin/bash -c “(out/host/linux-x86/bin/checkpolicy -M -c 30 -o out/target/product/hikey/obj/ETC/sepolicy_intermediates/sepolicy.tmp out/target/product/hikey/obj/ETC/sepolicy_intermediates/policy.conf ) && (out/host/linux-x86/bin/checkpolicy -M -c 30 -o out/target/product/hikey/obj/ETC/sepolicy_intermediates//sepolicy.dontaudit out/target/product/hikey/obj/ETC/sepolicy_intermediates/policy.conf.dontaudit ) && (out/host/linux-x86/bin/sepolicy-analyze out/target/product/hikey/obj/ETC/sepolicy_intermediates/sepolicy.tmp permissive > out/target/product/hikey/obj/ETC/sepolicy_intermediates/sepolicy.permissivedomains ) && (if [ “userdebug” = “user” -a -s out/target/product/hikey/obj/ETC/sepolicy_intermediates/sepolicy.permissivedomains ]; then echo “==========” 1>&2; echo “ERROR: permissive domains not allowed in user builds” 1>&2; echo “List of invalid domains:” 1>&2; cat out/target/product/hikey/obj/ETC/sepolicy_intermediates/sepolicy.permissivedomains 1>&2; exit 1; fi ) && (mv out/target/product/hikey/obj/ETC/sepolicy_intermediates/sepolicy.tmp out/target/product/hikey/obj/ETC/sepolicy_intermediates/sepolicy )”
device/linaro/hikey/sepolicy/hal_bluetooth_hikey.te:5:ERROR ‘syntax error’ at token ‘hal_server_domain’ on line 20715:

hal_server_domain(hal_bluetooth_hikey, hal_bluetooth)
checkpolicy: error(s) encountered while parsing configuration
out/host/linux-x86/bin/checkpolicy: loading policy configuration from out/target/product/hikey/obj/ETC/sepolicy_intermediates/policy.conf
[ 3% 1587/47715] host Java: doclava (out/host/common/obj/JAVA_LIBRARIES/doclava_intermediates/classes)
Note: Some input files use unchecked or unsafe operations.
Note: Recompile with -Xlint:unchecked for details.
[ 3% 1587/47715] target Java: core-all (out/target/common/obj/JAVA_LIBRARIES/core-all_intermediates/classes)
Note: Some input files use or override a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
Note: Some input files use unchecked or unsafe operations.
Note: Recompile with -Xlint:unchecked for details.
[ 3% 1587/47715] target Export Resources: framework-res (out/target/common/obj/APPS/framework-res_intermediates/package-export.apk)
warning: string ‘candidates_style’ has no default translation.
warning: string ‘gsm_alphabet_default_charset’ has no default translation.
warning: string ‘wfcSpnFormat’ has no default translation.
ninja: build stopped: subcommand failed.
make: *** [ninja_wrapper] Error 1

as i see while applying patches 4th patch(./android-patchsets/swg-mods) in the order is not applying correctly.

does it matter ?

Please help me for this compilation issue.

Thanks,
Raj.