* [Buildroot] [PATCH 1/1] boot/arm-trusted-firmware add Trusted Board Boot option @ 2025-01-06 10:22 Jean-Christophe Bauduin via buildroot 2025-01-06 14:47 ` [Buildroot] [PATCH v2 " Jean-Christophe Bauduin via buildroot 0 siblings, 1 reply; 3+ messages in thread From: Jean-Christophe Bauduin via buildroot @ 2025-01-06 10:22 UTC (permalink / raw) To: buildroot; +Cc: Jean-Christophe Bauduin, Sergey Matyukevich This patch adds the fields to enable trusted boot. Giving the option to use custom ROT keys. It also provides an option to build and link a specific version of mbedTLS inside of ATF package. Signed-off-by: Jean-Christophe Bauduin <jean-christophe.bauduin@mind.be> --- boot/arm-trusted-firmware/Config.in | 23 +++++++++++++ .../arm-trusted-firmware.mk | 32 ++++++++++++++++++- 2 files changed, 54 insertions(+), 1 deletion(-) diff --git a/boot/arm-trusted-firmware/Config.in b/boot/arm-trusted-firmware/Config.in index c8deede9cd..80efc3e35d 100644 --- a/boot/arm-trusted-firmware/Config.in +++ b/boot/arm-trusted-firmware/Config.in @@ -273,4 +273,27 @@ config BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_LEVEL default "strong" if BR2_SSP_STRONG default "all" if BR2_SSP_ALL +config BR2_TARGET_ARM_TRUSTED_FIRMWARE_TRUSTED_BOARD_BOOT + bool "Enable Trusted Board boot" + help + Enables trusted board boot. + More info: + https://wiki.st.com/stm32mpu/wiki/TF-A_BL2_Trusted_Board_Boot + +endif + +if BR2_TARGET_ARM_TRUSTED_FIRMWARE_TRUSTED_BOARD_BOOT + +config BR2_TARGET_ARM_TRUSTED_FIRMWARE_ROT_KEY + string "Path to the ROT private key" + help + The path to the private ROT key used by ATF. + The private key must be in PEM format. + +config BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION + string "The version number (ex 2.8) needed for the secure boot" + help + This option will enable the build of the specific version + of mbedtls required for TFA trusted boot. + For ATF lts-v2.10.5 use 3.6.2 endif diff --git a/boot/arm-trusted-firmware/arm-trusted-firmware.mk b/boot/arm-trusted-firmware/arm-trusted-firmware.mk index 172a930b5c..dfd4480ba6 100644 --- a/boot/arm-trusted-firmware/arm-trusted-firmware.mk +++ b/boot/arm-trusted-firmware/arm-trusted-firmware.mk @@ -18,6 +18,25 @@ else # Handle stable official ATF versions ARM_TRUSTED_FIRMWARE_SITE = https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git ARM_TRUSTED_FIRMWARE_SITE_METHOD = git + +ifneq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION),) +ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE = mbedtls-$(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION)) + +ARM_TRUSTED_FIRMWARE_MBEDTLS_SITE = https://codeload.github.com/Mbed-TLS/mbedtls/tar.gz/refs/tags/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) + +define ARM_TRUSTED_FIRMWARE_MBEDTLS_EXTRACT_CMDS + $(WGET) -O $(DL_DIR)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) $(ARM_TRUSTED_FIRMWARE_MBEDTLS_SITE) + mkdir -p $(@D)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) + $(TAR) -xvf $(DL_DIR)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) -C $(@D)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) --strip-components=1 +endef + +define ARM_TRUSTED_FIRMWARE_MBEDTLS_BUILD_CMDS + $(MAKE) -C $(@D)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) \ + CFLAGS="$(TARGET_CFLAGS)" LDFLAGS="$(TARGET_LDFLAGS)" lib +endef +ARM_TRUSTED_FIRMWARE_POST_EXTRACT_HOOKS += ARM_TRUSTED_FIRMWARE_MBEDTLS_EXTRACT_CMDS +endif + # The licensing of custom or from-git versions is unknown. # This is valid only for the latest (i.e. known) version. ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_LATEST_VERSION)$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_LATEST_LTS_2_10_VERSION)$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_LATEST_LTS_2_8_VERSION),y) @@ -190,12 +209,24 @@ define ARM_TRUSTED_FIRMWARE_BL31_UBOOT_INSTALL_ELF endef endif +ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_TRUSTED_BOARD_BOOT),y) +ARM_TRUSTED_FIRMWARE_TRUSTED_BOOT_ROT_KEY=$(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_ROT_KEY)) +ARM_TRUSTED_FIRMWARE_MAKE_OPTS += \ + ROT_KEY=$(ARM_TRUSTED_FIRMWARE_TRUSTED_BOOT_ROT_KEY) \ + MBEDTLS_DIR=$(@D)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) \ + GENERATE_COT=1 \ + TRUSTED_BOARD_BOOT=1 +endif + ARM_TRUSTED_FIRMWARE_MAKE_TARGETS += \ $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_ADDITIONAL_TARGETS)) ARM_TRUSTED_FIRMWARE_CUSTOM_DTS_PATH = $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_DTS_PATH)) define ARM_TRUSTED_FIRMWARE_BUILD_CMDS + $(if $(BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION), + $(ARM_TRUSTED_FIRMWARE_MBEDTLS_BUILD_CMDS) + ) $(if $(ARM_TRUSTED_FIRMWARE_CUSTOM_DTS_PATH), cp -f $(ARM_TRUSTED_FIRMWARE_CUSTOM_DTS_PATH) $(@D)/fdts/ ) @@ -212,7 +243,6 @@ define ARM_TRUSTED_FIRMWARE_INSTALL_IMAGES_CMDS $(ARM_TRUSTED_FIRMWARE_BL31_UBOOT_INSTALL) $(ARM_TRUSTED_FIRMWARE_BL31_UBOOT_INSTALL_ELF) endef - # Configuration check ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE)$(BR_BUILDING),yy) -- 2.43.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 3+ messages in thread
* [Buildroot] [PATCH v2 1/1] boot/arm-trusted-firmware add Trusted Board Boot option 2025-01-06 10:22 [Buildroot] [PATCH 1/1] boot/arm-trusted-firmware add Trusted Board Boot option Jean-Christophe Bauduin via buildroot @ 2025-01-06 14:47 ` Jean-Christophe Bauduin via buildroot 2026-10-11 12:56 ` Thomas Petazzoni via buildroot 0 siblings, 1 reply; 3+ messages in thread From: Jean-Christophe Bauduin via buildroot @ 2025-01-06 14:47 UTC (permalink / raw) To: buildroot Cc: Jean-Christophe Bauduin, Javad Rahimipetroudi, Sergey Matyukevich This patch adds the fields to enable trusted boot. Giving the option to use custom ROT keys. It also provides an option to build and link a specific version of mbedTLS inside of ATF package. Co-authored-by: Javad Rahimipetroudi <javad.rahimipetroudi@mind.be> Signed-off-by: Jean-Christophe Bauduin <jean-christophe.bauduin@mind.be> --- Changes v1 -> v2: - adding Javad Rahimipetroudi as co-author boot/arm-trusted-firmware/Config.in | 23 +++++++++++++ .../arm-trusted-firmware.mk | 32 ++++++++++++++++++- 2 files changed, 54 insertions(+), 1 deletion(-) diff --git a/boot/arm-trusted-firmware/Config.in b/boot/arm-trusted-firmware/Config.in index c8deede9cd..80efc3e35d 100644 --- a/boot/arm-trusted-firmware/Config.in +++ b/boot/arm-trusted-firmware/Config.in @@ -273,4 +273,27 @@ config BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_LEVEL default "strong" if BR2_SSP_STRONG default "all" if BR2_SSP_ALL +config BR2_TARGET_ARM_TRUSTED_FIRMWARE_TRUSTED_BOARD_BOOT + bool "Enable Trusted Board boot" + help + Enables trusted board boot. + More info: + https://wiki.st.com/stm32mpu/wiki/TF-A_BL2_Trusted_Board_Boot + +endif + +if BR2_TARGET_ARM_TRUSTED_FIRMWARE_TRUSTED_BOARD_BOOT + +config BR2_TARGET_ARM_TRUSTED_FIRMWARE_ROT_KEY + string "Path to the ROT private key" + help + The path to the private ROT key used by ATF. + The private key must be in PEM format. + +config BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION + string "The version number (ex 2.8) needed for the secure boot" + help + This option will enable the build of the specific version + of mbedtls required for TFA trusted boot. + For ATF lts-v2.10.5 use 3.6.2 endif diff --git a/boot/arm-trusted-firmware/arm-trusted-firmware.mk b/boot/arm-trusted-firmware/arm-trusted-firmware.mk index 172a930b5c..dfd4480ba6 100644 --- a/boot/arm-trusted-firmware/arm-trusted-firmware.mk +++ b/boot/arm-trusted-firmware/arm-trusted-firmware.mk @@ -18,6 +18,25 @@ else # Handle stable official ATF versions ARM_TRUSTED_FIRMWARE_SITE = https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git ARM_TRUSTED_FIRMWARE_SITE_METHOD = git + +ifneq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION),) +ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE = mbedtls-$(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION)) + +ARM_TRUSTED_FIRMWARE_MBEDTLS_SITE = https://codeload.github.com/Mbed-TLS/mbedtls/tar.gz/refs/tags/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) + +define ARM_TRUSTED_FIRMWARE_MBEDTLS_EXTRACT_CMDS + $(WGET) -O $(DL_DIR)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) $(ARM_TRUSTED_FIRMWARE_MBEDTLS_SITE) + mkdir -p $(@D)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) + $(TAR) -xvf $(DL_DIR)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) -C $(@D)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) --strip-components=1 +endef + +define ARM_TRUSTED_FIRMWARE_MBEDTLS_BUILD_CMDS + $(MAKE) -C $(@D)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) \ + CFLAGS="$(TARGET_CFLAGS)" LDFLAGS="$(TARGET_LDFLAGS)" lib +endef +ARM_TRUSTED_FIRMWARE_POST_EXTRACT_HOOKS += ARM_TRUSTED_FIRMWARE_MBEDTLS_EXTRACT_CMDS +endif + # The licensing of custom or from-git versions is unknown. # This is valid only for the latest (i.e. known) version. ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_LATEST_VERSION)$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_LATEST_LTS_2_10_VERSION)$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_LATEST_LTS_2_8_VERSION),y) @@ -190,12 +209,24 @@ define ARM_TRUSTED_FIRMWARE_BL31_UBOOT_INSTALL_ELF endef endif +ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_TRUSTED_BOARD_BOOT),y) +ARM_TRUSTED_FIRMWARE_TRUSTED_BOOT_ROT_KEY=$(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_ROT_KEY)) +ARM_TRUSTED_FIRMWARE_MAKE_OPTS += \ + ROT_KEY=$(ARM_TRUSTED_FIRMWARE_TRUSTED_BOOT_ROT_KEY) \ + MBEDTLS_DIR=$(@D)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) \ + GENERATE_COT=1 \ + TRUSTED_BOARD_BOOT=1 +endif + ARM_TRUSTED_FIRMWARE_MAKE_TARGETS += \ $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_ADDITIONAL_TARGETS)) ARM_TRUSTED_FIRMWARE_CUSTOM_DTS_PATH = $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_DTS_PATH)) define ARM_TRUSTED_FIRMWARE_BUILD_CMDS + $(if $(BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION), + $(ARM_TRUSTED_FIRMWARE_MBEDTLS_BUILD_CMDS) + ) $(if $(ARM_TRUSTED_FIRMWARE_CUSTOM_DTS_PATH), cp -f $(ARM_TRUSTED_FIRMWARE_CUSTOM_DTS_PATH) $(@D)/fdts/ ) @@ -212,7 +243,6 @@ define ARM_TRUSTED_FIRMWARE_INSTALL_IMAGES_CMDS $(ARM_TRUSTED_FIRMWARE_BL31_UBOOT_INSTALL) $(ARM_TRUSTED_FIRMWARE_BL31_UBOOT_INSTALL_ELF) endef - # Configuration check ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE)$(BR_BUILDING),yy) -- 2.43.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [Buildroot] [PATCH v2 1/1] boot/arm-trusted-firmware add Trusted Board Boot option 2025-01-06 14:47 ` [Buildroot] [PATCH v2 " Jean-Christophe Bauduin via buildroot @ 2026-10-11 12:56 ` Thomas Petazzoni via buildroot 0 siblings, 0 replies; 3+ messages in thread From: Thomas Petazzoni via buildroot @ 2026-10-11 12:56 UTC (permalink / raw) To: Jean-Christophe Bauduin Cc: buildroot, Javad Rahimipetroudi, Sergey Matyukevich Hello, Thanks for your patch, and sorry for the delay in getting back to you. We reviewed your patch (as part of the Buildroot Developers Meeting) and we have a number of questions/comments. See below. On Mon, Jan 06, 2025 at 03:47:10PM +0100, Jean-Christophe Bauduin via buildroot wrote: > +config BR2_TARGET_ARM_TRUSTED_FIRMWARE_TRUSTED_BOARD_BOOT > + bool "Enable Trusted Board boot" > + help > + Enables trusted board boot. > + More info: > + https://wiki.st.com/stm32mpu/wiki/TF-A_BL2_Trusted_Board_Boot > + > +endif > + > +if BR2_TARGET_ARM_TRUSTED_FIRMWARE_TRUSTED_BOARD_BOOT > + > +config BR2_TARGET_ARM_TRUSTED_FIRMWARE_ROT_KEY > + string "Path to the ROT private key" Why is the private key needed, and not just the public key? > + help > + The path to the private ROT key used by ATF. > + The private key must be in PEM format. Is it possible to add more details on how to generate the key in the expected format, or is that platform/vendor dependent? > +config BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION > + string "The version number (ex 2.8) needed for the secure boot" This description is not good, it should be: string "MbedTLS version" > + help And then here explain why it is needed, and perhaps how to figure out which one should be used. > diff --git a/boot/arm-trusted-firmware/arm-trusted-firmware.mk b/boot/arm-trusted-firmware/arm-trusted-firmware.mk > index 172a930b5c..dfd4480ba6 100644 > --- a/boot/arm-trusted-firmware/arm-trusted-firmware.mk > +++ b/boot/arm-trusted-firmware/arm-trusted-firmware.mk > @@ -18,6 +18,25 @@ else > # Handle stable official ATF versions > ARM_TRUSTED_FIRMWARE_SITE = https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git > ARM_TRUSTED_FIRMWARE_SITE_METHOD = git > + > +ifneq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION),) This won't work, as BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION being a string option, it's never empty. When no value is specified in menuconfig, the value of BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION will be "". So you need to do: ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION = $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION)) and then you can use $(ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION). > +ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE = mbedtls-$(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION)) > + > +ARM_TRUSTED_FIRMWARE_MBEDTLS_SITE = https://codeload.github.com/Mbed-TLS/mbedtls/tar.gz/refs/tags/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) > + > +define ARM_TRUSTED_FIRMWARE_MBEDTLS_EXTRACT_CMDS > + $(WGET) -O $(DL_DIR)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) $(ARM_TRUSTED_FIRMWARE_MBEDTLS_SITE) This is not good at all: you are downloading during the extract step. By doing this, you break offline build, you break hash integrity checking, and you don't account for the license of mbedtls in the license information. Instead, use EXTRA_DOWNLOADS. Make sure to update the license information as well. > + mkdir -p $(@D)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) > + $(TAR) -xvf $(DL_DIR)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) -C $(@D)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) --strip-components=1 > +endef > + > +define ARM_TRUSTED_FIRMWARE_MBEDTLS_BUILD_CMDS > + $(MAKE) -C $(@D)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) \ > + CFLAGS="$(TARGET_CFLAGS)" LDFLAGS="$(TARGET_LDFLAGS)" lib Second line should be indented with one more tab (minor detail). > +endef > +ARM_TRUSTED_FIRMWARE_POST_EXTRACT_HOOKS += ARM_TRUSTED_FIRMWARE_MBEDTLS_EXTRACT_CMDS > +endif > + > # The licensing of custom or from-git versions is unknown. > # This is valid only for the latest (i.e. known) version. > ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_LATEST_VERSION)$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_LATEST_LTS_2_10_VERSION)$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_LATEST_LTS_2_8_VERSION),y) > @@ -190,12 +209,24 @@ define ARM_TRUSTED_FIRMWARE_BL31_UBOOT_INSTALL_ELF > endef > endif > > +ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_TRUSTED_BOARD_BOOT),y) > +ARM_TRUSTED_FIRMWARE_TRUSTED_BOOT_ROT_KEY=$(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_ROT_KEY)) Spaces around = sign (minor detail). > +ARM_TRUSTED_FIRMWARE_MAKE_OPTS += \ > + ROT_KEY=$(ARM_TRUSTED_FIRMWARE_TRUSTED_BOOT_ROT_KEY) \ > + MBEDTLS_DIR=$(@D)/$(ARM_TRUSTED_FIRMWARE_MBEDTLS_SOURCE) \ > + GENERATE_COT=1 \ > + TRUSTED_BOARD_BOOT=1 > +endif > + > ARM_TRUSTED_FIRMWARE_MAKE_TARGETS += \ > $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_ADDITIONAL_TARGETS)) > > ARM_TRUSTED_FIRMWARE_CUSTOM_DTS_PATH = $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_DTS_PATH)) > > define ARM_TRUSTED_FIRMWARE_BUILD_CMDS > + $(if $(BR2_TARGET_ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION), Use ARM_TRUSTED_FIRMWARE_MBEDTLS_VERSION. Or perhaps better, use BR2_TARGET_ARM_TRUSTED_FIRMWARE_TRUSTED_BOARD_BOOT. Indeed, as soon as BR2_TARGET_ARM_TRUSTED_FIRMWARE_TRUSTED_BOARD_BOOT is y we need to build mbedtls, and if the user has forgotten to set the MbedTLS version, a clear build failure would be better than skipping the MbedTLS build. Could you have a look at those issues and submit a v3? Thanks a lot! Thomas -- Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training https://bootlin.com _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-13 17:55 UTC | newest] Thread overview: 3+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-01-06 10:22 [Buildroot] [PATCH 1/1] boot/arm-trusted-firmware add Trusted Board Boot option Jean-Christophe Bauduin via buildroot 2025-01-06 14:47 ` [Buildroot] [PATCH v2 " Jean-Christophe Bauduin via buildroot 2026-10-11 12:56 ` Thomas Petazzoni via buildroot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox