Re: [isar-cip-core][PATCH 3/8] Include optee into u-boot

["Su, Bao Cheng" <baocheng.su@siemens.com>]

On Mon, 2022-10-24 at 14:27 +0200, sven.schultschik@siemens.com wrote:
> From: Sven Schultschik <sven.schultschik@siemens.com>
> 
> Optee is part of u-boot In the secureboot scenario to use optee and RPMB as secure storage.
> 
> Signed-off-by: Sven Schultschik <sven.schultschik@siemens.com>
> ---
>  recipes-bsp/u-boot/files/secure-boot.cfg.tmpl | 7 +++++++
>  recipes-bsp/u-boot/u-boot-qemu-common.inc     | 2 ++
>  2 files changed, 9 insertions(+)
> 
> diff --git a/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl b/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl
> index 956dcbfed..8e6428238 100644
> --- a/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl
> +++ b/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl
> @@ -4,3 +4,10 @@ CONFIG_USE_BOOTCOMMAND=y
>  CONFIG_BOOTCOMMAND="setenv scan_dev_for_boot 'if test -e ${devtype} ${devnum}:${distro_bootpart} efi/boot/boot${EFI_ARCH}.efi; then load ${devtype} ${devnum}:${distro_bootpart} ${kernel_addr_r} efi/boot/boot${EFI_ARCH}.efi; bootefi ${kernel_addr_r} ${fdtcontroladdr}; fi'; run distro_bootcmd; echo 'EFI Boot failed!'; sleep 1000; reset"
>  CONFIG_EFI_VARIABLES_PRESEED=y
>  CONFIG_EFI_SECURE_BOOT=y
> +### OPTEE config
> +CONFIG_CMD_OPTEE_RPMB=y
> +CONFIG_MMC=y
> +CONFIG_SUPPORT_EMMC_RPMB=y
> +CONFIG_TEE=y
> +CONFIG_OPTEE=y
> +CONFIG_EFI_MM_COMM_TEE=y

According to lib/efi_loader/Makefile:

ifeq ($(CONFIG_EFI_MM_COMM_TEE),y)
obj-y += efi_variable_tee.o
else
obj-y += efi_variable.o
obj-$(CONFIG_EFI_VARIABLES_PRESEED) += efi_var_seed.o
endif

The `CONFIG_EFI_MM_COMM_TEE` conflicts with
`CONFIG_EFI_VARIABLES_PRESEED`, so you have to choose one.

- Baocheng

> diff --git a/recipes-bsp/u-boot/u-boot-qemu-common.inc b/recipes-bsp/u-boot/u-boot-qemu-common.inc
> index 0a9a15a0f..802fc5056 100644
> --- a/recipes-bsp/u-boot/u-boot-qemu-common.inc
> +++ b/recipes-bsp/u-boot/u-boot-qemu-common.inc
> @@ -13,6 +13,8 @@ require recipes-bsp/u-boot/u-boot-common.inc
>  
> 
> 
> 
>  U_BOOT_BIN = "u-boot.bin"
>  
> 
> 
> 
> +DEPENDS_append_secureboot = " optee-os-${MACHINE}"
> +
>  do_deploy[dirs] = "${DEPLOY_DIR_IMAGE}"
>  do_deploy() {
>      dpkg --fsys-tarfile "${WORKDIR}/u-boot-${MACHINE}_${PV}_${DISTRO_ARCH}.deb" | \