Re: [PATCH 0/8] sd: Add RPMB emulation to eMMC model

[Jan Kiszka <jan.kiszka@siemens.com>]

On 27.08.25 07:55, Jan Kiszka via OP-TEE wrote:
>>> On 24.08.25 09:18, Jan Kiszka wrote:
>>>> This closes an old gap in system integration testing for the very
>>>> complex ARM firmware stacks by adding fairly advanced Replay Protected
>>>> Memory Block (RPMB) emulation to the eMMC device model. Key programming
>>>> and message authentication are working, so is the write counter. Known
>>>> users are happy with the result. What is missing, but not only for RPMB-
>>>> related registers, is state persistence across QEMU restarts. This is OK
>>>> at this stage for most test scenarios, though, and could still be added
>>>> later on.
>>>>
>>>> What can already be done with it is demonstrated in the WIP branch of
>>>> isar-cip-core at [1]: TF-A + OP-TEE + StandaloneMM TA + fTPM TA, used by
>>>> U-Boot and Linux for UEFI variable storage and TPM scenarios. If you
>>>> want to try: build qemu-arm64 target for trixie with 6.12-cip *head*
>>>> kernel, enable secure boot and disk encryption, then run
>>>>
>>>> $ QEMU_PATH=/path/to/qemu-build/ ./start-qemu.sh
>>>>
>>>> Deploy snakeoil keys into PK, KEK and db after first boot to enable
>>>> secure booting:
>>>>
>>>> root@demo:~# cert-to-efi-sig-list PkKek-1-snakeoil.pem PK.esl
>>>> root@demo:~# sign-efi-sig-list -k PkKek-1-snakeoil.key -c PkKek-1-snakeoil.pem PK PK.esl PK.auth
>>>> root@demo:~# efi-updatevar -f PK.auth db
>>>> root@demo:~# efi-updatevar -f PK.auth KEK
>>>> root@demo:~# efi-updatevar -f PK.auth PK
>>>>
>>>> Note that emulation is a bit slow in general, and specifically the
>>>> partition encryption on first boot is taking 20 min. - we should
>>>> probably reduce its size or understand if there is still something to
>>>> optimize.
>>
>> Can you try with KVM enabled? I suppose that should allow you to use
>> Armv8 CPU Crypto Extensions.
> 
> Worth a try - will pull out some raspi or so and let you know.
> 

I finally found the time to set everything up - just to get this:

qemu-system-aarch64: mach-virt: KVM does not support providing Security
extensions (TrustZone) to the guest CPU

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center