WIP

Author: gsingh93

.gitignore

@@ -13,3 +13,5 @@ compile_commands.json
 /external/*
 !/external/external.mk
 !/external/README.md
+
+/trusty

Makefile

@@ -30,6 +30,14 @@ else ifeq ($(filter x86_64 arm64 i386,$(ARCH)),)
   $(error Invalid architecture $(ARCH))
 endif
 
+ifneq ($(ARCH),arm64)
+  # We currently only support Trusty with arm64, as we rely on ARM TF-A
+  ifneq ($(filter trusty,$(MAKECMDGOALS)),)
+    $(error Building Trusty is only supported on arm64)
+  endif
+endif
+
+
 .PHONY: default
 default: linux linux_modules tools-vm
 
@@ -384,6 +392,39 @@ uboot $(UBOOT_BIN): $(UBOOT_CONFIG) | $(CLANG_DIR)
 uboot_clean:
 	+ $(UBOOT_MAKE) mrproper
 
+##
+## Trusty
+##
+
+TRUSTY_SRC ?= $(ROOT_DIR)/trusty
+TRUSTY_TARGET ?= qemu-generic-arm64-test-debug
+TRUSTY_BUILD_ROOT ?= $(OUT_DIR)/trusty
+TRUSTY_OUT := $(TRUSTY_BUILD_ROOT)/build-$(TRUSTY_TARGET)
+
+ATF_DIR := $(TRUSTY_OUT)/atf/qemu/debug
+ATF_BL1 := $(ATF_DIR)/bl1.bin
+ATF_BL33 := $(ATF_DIR)/bl33.bin
+
+.PHONY: trusty-init
+trusty-init:
+	mkdir -p $(TRUSTY_SRC)
+	cd $(TRUSTY_SRC) && repo init -u https://android.googlesource.com/trusty/manifest -b main
+	cd $(TRUSTY_SRC) && repo sync -j`nproc` -c --no-tags
+
+.PHONY: trusty
+trusty $(ATF_BL1): | $(TRUSTY_SRC)
+	$(TRUSTY_SRC)/trusty/vendor/google/aosp/scripts/build.py --build-root $(TRUSTY_BUILD_ROOT) --skip-tests $(TRUSTY_TARGET)
+	$(MAKE) trusty_bl33
+
+.PHONY: trusty_bl33
+trusty_bl33 $(ATF_BL33): $(UBOOT_BIN)
+	rm $(ATF_BL33)
+	cp $(UBOOT_BIN) $(ATF_BL33)
+
+.PHONY: trusty_clean
+trusty_clean:
+	rm -rf $(TRUSTY_OUT)
+
 ##
 ## Run QEMU
 ##
@@ -400,7 +441,9 @@ ECHR ?= 1
 ROOT ?= /dev/vda
 RW ?= rw
 KASLR ?= 0
+
 UBOOT ?= 0
+TRUSTY ?= 0
 
 QEMU_KERNEL_CMDLINE := selinux=0
 
@@ -410,16 +453,23 @@ QEMU_ARGS := \
   -nographic \
   -no-reboot \
   -kernel $(QEMU_KERNEL_IMAGE) \
-  -netdev user,id=eth0,hostfwd=tcp::7777-:7777,hostfwd=tcp::2222-:22,hostfwd=tcp::2223-:23 -device virtio-net-pci,netdev=eth0 \
-  -virtfs local,security_model=mapped-xattr,path=$(SHARED_DIR),mount_tag=shared \
-  -virtfs local,security_model=mapped-xattr,path=$(LINUX_MODULES_INSTALL_PATH)/lib/modules,mount_tag=modules \
   -echr $(ECHR) \
   $(QEMU_EXTRA_ARGS)
 
-ifeq ($(UBOOT),1)
+ifeq ($(TRUSTY),1)
+  QEMU_ARGS += -bios $(ATF_BL1)
+else ifeq ($(UBOOT),1)
   QEMU_ARGS += -bios $(UBOOT_BIN)
 endif
 
+ifneq ($(TRUSTY),1)
+  # Trusty currently only works with a very old version of QEMU, these flags
+  # don't seem to work with it
+  QEMU_ARGS += -netdev user,id=eth0,hostfwd=tcp::7777-:7777,hostfwd=tcp::2222-:22,hostfwd=tcp::2223-:23 -device virtio-net-pci,netdev=eth0
+  QEMU_ARGS += -virtfs local,security_model=mapped-xattr,path=$(SHARED_DIR),mount_tag=shared
+  QEMU_ARGS += -virtfs local,security_model=mapped-xattr,path=$(LINUX_MODULES_INSTALL_PATH)/lib/modules,mount_tag=modules
+endif
+
 ifneq ($(INITRD),)
   ifeq ($(INITRD),1)
     INITRD := $(CPIO_FILE)
@@ -436,7 +486,7 @@ ifeq ($(GDB),1)
 endif
 
 ifeq ($(ARCH),x86_64)
-  QEMU_BIN := qemu-system-x86_64
+  QEMU_BIN ?= qemu-system-x86_64
 
   # 8250.nr_uarts=1 is needed because some Android kernels set
   # `CONFIG_SERIAL_8250_RUNTIME_UARTS` to zero
@@ -449,14 +499,26 @@ ifeq ($(ARCH),x86_64)
     QEMU_ARGS += -accel kvm
   endif
 else ifeq ($(ARCH),i386)
-  QEMU_BIN := qemu-system-i386
+  QEMU_BIN ?= qemu-system-i386
   QEMU_KERNEL_CMDLINE += console=ttyS0
 else
-  QEMU_BIN := qemu-system-aarch64
+  ifeq ($(TRUSTY),1)
+    # Trusty currently only runs with its patched build of QEMU
+    QEMU_BIN ?= $(TRUSTY_OUT)/qemu-build/aarch64-softmmu/qemu-system-aarch64
+  else
+	QEMU_BIN ?= qemu-system-aarch64
+  endif
+
   QEMU_KERNEL_CMDLINE += console=ttyAMA0
 
+  ifeq ($(TRUSTY),1)
+    MACHINE := -machine virt,secure=on,virtualization=on
+  else
+    MACHINE := -machine virt,virtualization=on
+  endif
+
   QEMU_ARGS += \
-    -M virt \
+    $(MACHINE) \
     -cpu cortex-a53 \
     -semihosting-config enable=on,target=native
 endif
@@ -474,10 +536,18 @@ endif
 QEMU_ARGS += -append "$(QEMU_KERNEL_CMDLINE) $(QEMU_EXTRA_KERNEL_CMDLINE)"
 
 RUN_DEPS := $(QEMU_KERNEL_IMAGE)
+RUN_DIR := $(ROOT_DIR)
+
 ifeq ($(UBOOT),1)
   RUN_DEPS += $(UBOOT_BIN)
 endif
 
+ifeq ($(TRUSTY),1)
+  RUN_DEPS += $(ATF_BL1)
+  # TODO: Is there a QEMU flag we can use to make this not necessary?
+  RUN_DIR := $(ATF_DIR)
+endif
+
 # Make sure the modules directory exists, even if it's empty. Otherwise mount
 # will fail.
 $(LINUX_MODULES_INSTALL_PATH)/lib/modules:
@@ -496,7 +566,7 @@ endif
 
 endif
 	@echo ''
-	$(QEMU_BIN) $(QEMU_ARGS)
+	cd $(RUN_DIR) && $(QEMU_BIN) $(QEMU_ARGS)
 
 .PHONY: run-ack
 run-ack: run