Full secure boot with qemuarm64

Full secure boot with qemuarm64

[Michael Grand]

[-- Attachment #1: Type: text/plain, Size: 582 bytes --]

Dear all,

I'm trying to develop a PoC of a fully secure embedded software. Because this PoC is intended for educational use, I don't want to depend on a specific hardware vendor and therefore, I'm using qemuarm64 as target.

Unfortunately, i'm struggling in having a working secure boot (TF-A + OP-TEE + U-boot + kernel) and I cannot find useful (and working) information on the internet. Do somebody has some kind of a minimal working secure boot example based on qemuarm64 ?

Best regards,
Michael Grand

Envoyé à partir de Outlook pour Android<https://aka.ms/AAb9ysg>

[-- Attachment #2: Type: text/html, Size: 2135 bytes --]

Re: [meta-arm] Full secure boot with qemuarm64

[Mikko Rapeli]

Hi,

On Tue, Jul 15, 2025 at 07:57:28AM +0000, Michael Grand via lists.yoctoproject.org wrote:
> Dear all,
> 
> I'm trying to develop a PoC of a fully secure embedded software. Because this PoC is intended for educational use, I don't want to depend on a specific hardware vendor and therefore, I'm using qemuarm64 as target.
> 
> Unfortunately, i'm struggling in having a working secure boot (TF-A + OP-TEE + U-boot + kernel) and I cannot find useful (and working) information on the internet. Do somebody has some kind of a minimal working secure boot example based on qemuarm64 ?

Check the meta-arm layer and build for example
"kas build ci/qemuarm64-secureboot:ci/uefi-secureboot.yml:ci/testimage.yml"

These build u-boot for UEFI secureboot and then load a UKI binary
signed with matching keys, which includes kernel and initrd.

The testimage part boots the thing with u-boot and checks that
boot was secure. The config files have the details.

Hope this helps,

-Mikko

Re: [meta-arm] Full secure boot with qemuarm64

[Mikko Rapeli]

Hi,

On Tue, Jul 15, 2025 at 11:06:41AM +0300, Mikko Rapeli via lists.yoctoproject.org wrote:
> On Tue, Jul 15, 2025 at 07:57:28AM +0000, Michael Grand via lists.yoctoproject.org wrote:
> > Dear all,
> > 
> > I'm trying to develop a PoC of a fully secure embedded software. Because this PoC is intended for educational use, I don't want to depend on a specific hardware vendor and therefore, I'm using qemuarm64 as target.
> > 
> > Unfortunately, i'm struggling in having a working secure boot (TF-A + OP-TEE + U-boot + kernel) and I cannot find useful (and working) information on the internet. Do somebody has some kind of a minimal working secure boot example based on qemuarm64 ?
> 
> Check the meta-arm layer and build for example
> "kas build ci/qemuarm64-secureboot:ci/uefi-secureboot.yml:ci/testimage.yml"
> 
> These build u-boot for UEFI secureboot and then load a UKI binary
> signed with matching keys, which includes kernel and initrd.
> 
> The testimage part boots the thing with u-boot and checks that
> boot was secure. The config files have the details.

Boots with qemu, I mean to write.

Cheers,

-Mikko

RE: [meta-arm] Full secure boot with qemuarm64

[Michael Grand]

Thank you for the suggestion. Initially, I didn't want to use UEFI to keep the things simples, but I will give it a try. I was also using scarthgap and uefi-secureboot.yml is only available in walnascar branch but it does not really matter as this is only for educational purposes.

Best regards,
Michael Grand
 
-----Message d'origine-----
De : Mikko Rapeli <mikko.rapeli@linaro.org> 
Envoyé : mardi 15 juillet 2025 10:20
À : Michael Grand <m.grand@trustngo.tech>; meta-arm@lists.yoctoproject.org
Objet : Re: [meta-arm] Full secure boot with qemuarm64

Hi,

On Tue, Jul 15, 2025 at 11:06:41AM +0300, Mikko Rapeli via lists.yoctoproject.org wrote:
> On Tue, Jul 15, 2025 at 07:57:28AM +0000, Michael Grand via lists.yoctoproject.org wrote:
> > Dear all,
> > 
> > I'm trying to develop a PoC of a fully secure embedded software. Because this PoC is intended for educational use, I don't want to depend on a specific hardware vendor and therefore, I'm using qemuarm64 as target.
> > 
> > Unfortunately, i'm struggling in having a working secure boot (TF-A + OP-TEE + U-boot + kernel) and I cannot find useful (and working) information on the internet. Do somebody has some kind of a minimal working secure boot example based on qemuarm64 ?
> 
> Check the meta-arm layer and build for example "kas build 
> ci/qemuarm64-secureboot:ci/uefi-secureboot.yml:ci/testimage.yml"
> 
> These build u-boot for UEFI secureboot and then load a UKI binary 
> signed with matching keys, which includes kernel and initrd.
> 
> The testimage part boots the thing with u-boot and checks that boot 
> was secure. The config files have the details.

Boots with qemu, I mean to write.

Cheers,

-Mikko