[PATCH v2 6/7] initramfs: Add recipe for tee-supplicant hook

[baocheng_su@163.com]

From: Baocheng Su <baocheng.su@siemens.com>

This adds the tee-supplicant hook so that the tee supplicant daemon is
started at the initrd stage.

The tee-supplicant daemon is used to provide service to trust
applications running in optee, for example to provide RPMB access
service for StMM or fTPM TAs.

By running tee-supplicant at initrd stage, disk encryption based on fTPM
is possible.

stm32mp15x is used to demo the building of this hook, so add a new ci
target for the initramfs image of stm32mp15x.

Signed-off-by: Baocheng Su <baocheng.su@siemens.com>
---
 .../images/stm32mp15x-initramfs.bb            | 14 ++++++++
 .../files/tee-supplicant.hook                 | 33 +++++++++++++++++++
 .../files/tee-supplicant.script               | 33 +++++++++++++++++++
 .../initramfs-tee-supplicant-hook_0.1.bb      | 27 +++++++++++++++
 testsuite/citest.py                           |  1 +
 5 files changed, 108 insertions(+)
 create mode 100644 meta-isar/recipes-initramfs/images/stm32mp15x-initramfs.bb
 create mode 100644 meta/recipes-initramfs/initramfs-tee-supplicant-hook/files/tee-supplicant.hook
 create mode 100644 meta/recipes-initramfs/initramfs-tee-supplicant-hook/files/tee-supplicant.script
 create mode 100644 meta/recipes-initramfs/initramfs-tee-supplicant-hook/initramfs-tee-supplicant-hook_0.1.bb

diff --git a/meta-isar/recipes-initramfs/images/stm32mp15x-initramfs.bb b/meta-isar/recipes-initramfs/images/stm32mp15x-initramfs.bb
new file mode 100644
index 0000000..211c201
--- /dev/null
+++ b/meta-isar/recipes-initramfs/images/stm32mp15x-initramfs.bb
@@ -0,0 +1,14 @@
+#
+# Copyright (c) Siemens AG, 2023
+#
+# Authors:
+#  Su Bao Cheng <baocheng.su@siemens.com>
+#
+# SPDX-License-Identifier: MIT
+#
+
+inherit initramfs
+
+INITRAMFS_INSTALL += " \
+    initramfs-tee-supplicant-hook \
+    "
diff --git a/meta/recipes-initramfs/initramfs-tee-supplicant-hook/files/tee-supplicant.hook b/meta/recipes-initramfs/initramfs-tee-supplicant-hook/files/tee-supplicant.hook
new file mode 100644
index 0000000..0af277b
--- /dev/null
+++ b/meta/recipes-initramfs/initramfs-tee-supplicant-hook/files/tee-supplicant.hook
@@ -0,0 +1,33 @@
+#!/bin/sh
+# Copyright (c) Siemens AG, 2023
+#
+# Authors:
+#  Su Bao Cheng <baocheng.su@siemens.com>
+#
+# SPDX-License-Identifier: MIT
+#
+PREREQ=""
+prereqs()
+{
+    echo "$PREREQ"
+}
+case $1 in
+prereqs)
+    prereqs
+    exit 0
+    ;;
+esac
+
+. /usr/share/initramfs-tools/hook-functions
+
+hook_error() {
+    echo "(ERROR): $2" >&2
+    exit 1
+}
+
+# For stock debian bookworm arm64 kernel, these two .ko exist, but not built-in.
+manual_add_modules tee
+manual_add_modules optee
+
+copy_exec /usr/sbin/tee-supplicant || hook_error "/usr/sbin/tee-supplicant not found"
+copy_exec /usr/bin/pgrep || hook_error "/usr/bin/pgrep not found"
diff --git a/meta/recipes-initramfs/initramfs-tee-supplicant-hook/files/tee-supplicant.script b/meta/recipes-initramfs/initramfs-tee-supplicant-hook/files/tee-supplicant.script
new file mode 100644
index 0000000..bb6dcc1
--- /dev/null
+++ b/meta/recipes-initramfs/initramfs-tee-supplicant-hook/files/tee-supplicant.script
@@ -0,0 +1,33 @@
+#!/bin/sh
+# Copyright (c) Siemens AG, 2023
+#
+# Authors:
+#  Su Bao Cheng <baocheng.su@siemens.com>
+#
+# SPDX-License-Identifier: MIT
+#
+PREREQ=""
+prereqs()
+{
+	echo "$PREREQ"
+}
+case $1 in
+prereqs)
+	prereqs
+	exit 0
+	;;
+esac
+
+. /scripts/functions
+
+/usr/sbin/tee-supplicant -d
+
+# The tee-supplicant would take some time to be discovered, 10 seconds should be
+# enough
+wait_sec=10
+until test $wait_sec -eq 0 || test -c "${FTPM_DEV}" ; do
+	wait_sec=$((wait_sec-1))
+	sleep 1
+done
+
+/usr/bin/pgrep tee-supplicant > /dev/null || panic "Can't start the tee-supplicant daemon!"
diff --git a/meta/recipes-initramfs/initramfs-tee-supplicant-hook/initramfs-tee-supplicant-hook_0.1.bb b/meta/recipes-initramfs/initramfs-tee-supplicant-hook/initramfs-tee-supplicant-hook_0.1.bb
new file mode 100644
index 0000000..3768b8e
--- /dev/null
+++ b/meta/recipes-initramfs/initramfs-tee-supplicant-hook/initramfs-tee-supplicant-hook_0.1.bb
@@ -0,0 +1,27 @@
+# Copyright (c) Siemens AG, 2023
+#
+# Authors:
+#  Su Bao Cheng <baocheng.su@siemens.com>
+#
+# SPDX-License-Identifier: MIT
+#
+
+inherit dpkg-raw
+
+SRC_URI += " \
+    file://tee-supplicant.hook \
+    file://tee-supplicant.script \
+    "
+
+DEBIAN_DEPENDS = "initramfs-tools, tee-supplicant, procps"
+
+do_install[cleandirs] += " \
+    ${D}/usr/share/initramfs-tools/hooks \
+    ${D}/usr/share/initramfs-tools/scripts/local-bottom"
+
+do_install() {
+    install -m 0755 "${WORKDIR}/tee-supplicant.hook" \
+        "${D}/usr/share/initramfs-tools/hooks/tee-supplicant"
+    install -m 0755 "${WORKDIR}/tee-supplicant.script" \
+        "${D}/usr/share/initramfs-tools/scripts/local-bottom/tee-supplicant"
+}
diff --git a/testsuite/citest.py b/testsuite/citest.py
index 17a9024..1aa2928 100755
--- a/testsuite/citest.py
+++ b/testsuite/citest.py
@@ -214,6 +214,7 @@ class NoCrossTest(CIBaseTest):
             'mc:bananapi-bullseye:isar-image-base',
             'mc:nanopi-neo-bullseye:isar-image-base',
             'mc:stm32mp15x-bullseye:isar-image-base',
+            'mc:stm32mp15x-bullseye:stm32mp15x-initramfs',
             'mc:qemuamd64-focal:isar-image-ci'
                   ]
 
-- 
2.30.2