optee-utee-sys,optee-teec-sys: generate the FFI bindings instead of maintaining them by hand

.github/workflows/ci.yml

@@ -42,8 +42,9 @@ jobs:
       runs-on: ubuntu-24.04-arm
       container: ghcr.io/ivila/teaclave-trustzone-sdk-ci-runner:ubuntu-24.04
 
-  # Run systest of optee_teec and build systest of optee_utee on ARM64
-  systest:
+  # Regenerate the committed `*-sys` bindings from the OP-TEE release pinned in
+  # optee-version.txt and fail if the committed files are stale.
+  check-generated-bindings:
     runs-on: ubuntu-24.04-arm
     container: ghcr.io/ivila/teaclave-trustzone-sdk-ci-runner:ubuntu-24.04
     steps:
@@ -56,23 +57,41 @@ jobs:
           path: |
             ~/.cargo/registry/cache
             ~/.cargo/registry/index
-          key: cargo-v1-systest-${{ hashFiles('rust-toolchain.toml') }}
+          key: cargo-v1-bindings-${{ hashFiles('rust-toolchain.toml') }}
           restore-keys: |
-            cargo-v1-systest-
+            cargo-v1-bindings-
 
-      - name: Prepare Environment
+      - name: Install libclang
+        run: |
+          # bindgen dlopens libclang at run time and the runner image does not
+          # ship it.
+          apt-get update
+          apt-get install -y --no-install-recommends libclang-dev
+          echo "LIBCLANG_PATH=$(dirname "$(find /usr/lib -name libclang.so -print -quit)")" >> "$GITHUB_ENV"
+
+      - name: Regenerate the bindings
         run: |
           # Setup Rust and toolchains
           ./setup.sh
           source "$HOME/.cargo/env"
-          # Build optee_os and optee_client for qemu_v8
-          ./build_optee_libraries.sh $HOME
-          # Setup environment
-          export OPTEE_DIR=$HOME
+
+          # Build the dev kit and client export of the pinned OP-TEE release
+          ./build_optee_libraries.sh "$HOME"
+          export OPTEE_DIR="$HOME"
           source environment
-          # Run systest
-          export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$OPTEE_DIR/optee_client/export_arm64/usr/lib
-          (cd crates && cargo run -p optee-teec-systest && cargo build -p optee-utee-systest)
+
+          cargo run --manifest-path xtask/Cargo.toml -- generate-bindings all
+
+      - name: Fail if the committed bindings are stale
+        run: |
+          # The step runs as root inside the container while the workspace
+          # belongs to the runner user, so git has to be told that the
+          # repository is safe before it will read the index.
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+          git diff --exit-code -- \
+            crates/optee-utee-sys/src/generated.rs \
+            crates/optee-teec-sys/src/generated.rs
 
   # Build examples in the emulator image: arch × std.
   test-build-on-dev-docker:

.gitignore

@@ -29,6 +29,10 @@ rust/
 !examples/ca/Cargo.lock
 !projects/web3/eth_wallet/ta/Cargo.lock
 
+# Pin the exact bindgen (and its dependencies) used to regenerate the committed
+# `*-sys` bindings.
+!xtask/Cargo.lock
+
 # Allow tracking Cargo.lock for cargo-optee tool
 !cargo-optee/Cargo.lock
 

.licenserc.yaml

@@ -33,3 +33,4 @@ header:
     - 'examples/ta/tls_server-rs/test-ca/**'
     - 'optee-version.txt'
     - '**/*.stderr'
+    - '**/*.in'

crates/Cargo.toml

@@ -22,12 +22,10 @@ members = [
     "optee-teec-build",
     "optee-teec-macros",
     "optee-teec-sys",
-    "optee-teec-systest",
     "optee-utee",
     "optee-utee-build",
     "optee-utee-macros",
     "optee-utee-sys",
-    "optee-utee-systest",
     "rustls_provider",
     "secure_db"
 ]
@@ -62,8 +60,6 @@ serde = { version = "1.0.229" }
 serde_json = { version = "1.0.154" }
 log = "0.4.35"
 document-features = "0.2.12"
-ctest = "0.5.1"
-cc = "1.10.0"
 prettyplease = "0.3.0"
 libc_alloc = "1.0.7"
 strum = { version = "0.28", default-features = false }

crates/optee-teec-build/src/plugin.rs

@@ -134,8 +134,8 @@ fn generate_binding(
                     timeHiAndVersion: #uuid_f3,
                     clockSeqAndNode: [#(#uuid_f4),*],
                 },
-                init: #init_fn_name,
-                invoke: #invoke_fn_name,
+                init: Some(#init_fn_name),
+                invoke: Some(#invoke_fn_name),
             };
         };
     }

crates/optee-teec-macros/src/lib.rs

@@ -172,8 +172,8 @@ pub fn plugin_invoke(_args: TokenStream, input: TokenStream) -> TokenStream {
             cmd: u32,
             sub_cmd: u32,
             data: *mut core::ffi::c_void,
-            in_len: optee_teec::raw::size_t,
-            out_len: *mut optee_teec::raw::size_t,
+            in_len: usize,
+            out_len: *mut usize,
         ) -> optee_teec::raw::TEEC_Result {
             let mut parameter = match unsafe {
                 optee_teec::PluginParameters::from_raw(