Re: [isar-cip-core][PATCH 3/8] Include optee into u-boot

[Jan Kiszka <jan.kiszka@siemens.com>]

On 26.10.22 17:27, Schultschik, Sven (DI PA DCP R&D 2) wrote:
> 
> 
>> -----Ursprüngliche Nachricht-----
>> Von: Kiszka, Jan (T CED) <jan.kiszka@siemens.com>
>> Gesendet: Mittwoch, 26. Oktober 2022 10:53
>> An: Su, Bao Cheng (DI FA CTR IPC CN PRC4) <baocheng.su@siemens.com>;
>> Schultschik, Sven (DI PA DCP R&D 2) <sven.schultschik@siemens.com>; cip-
>> dev@lists.cip-project.org
>> Betreff: Re: [isar-cip-core][PATCH 3/8] Include optee into u-boot
>>
>> On 26.10.22 09:36, Su, Bao Cheng wrote:
>>> On Mon, 2022-10-24 at 14:27 +0200, sven.schultschik@siemens.com wrote:
>>>> From: Sven Schultschik <sven.schultschik@siemens.com>
>>>>
>>>> Optee is part of u-boot In the secureboot scenario to use optee and RPMB as
>> secure storage.
>>>>
>>>> Signed-off-by: Sven Schultschik <sven.schultschik@siemens.com>
>>>> ---
>>>>  recipes-bsp/u-boot/files/secure-boot.cfg.tmpl | 7 +++++++
>>>>  recipes-bsp/u-boot/u-boot-qemu-common.inc     | 2 ++
>>>>  2 files changed, 9 insertions(+)
>>>>
>>>> diff --git a/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl
>>>> b/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl
>>>> index 956dcbfed..8e6428238 100644
>>>> --- a/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl
>>>> +++ b/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl
>>>> @@ -4,3 +4,10 @@ CONFIG_USE_BOOTCOMMAND=y
>>>>  CONFIG_BOOTCOMMAND="setenv scan_dev_for_boot 'if test -e ${devtype}
>> ${devnum}:${distro_bootpart} efi/boot/boot${EFI_ARCH}.efi; then load
>> ${devtype} ${devnum}:${distro_bootpart} ${kernel_addr_r}
>> efi/boot/boot${EFI_ARCH}.efi; bootefi ${kernel_addr_r} ${fdtcontroladdr}; fi';
>> run distro_bootcmd; echo 'EFI Boot failed!'; sleep 1000; reset"
>>>>  CONFIG_EFI_VARIABLES_PRESEED=y
>>>>  CONFIG_EFI_SECURE_BOOT=y
>>>> +### OPTEE config
>>>> +CONFIG_CMD_OPTEE_RPMB=y
>>>> +CONFIG_MMC=y
>>>> +CONFIG_SUPPORT_EMMC_RPMB=y
>>>> +CONFIG_TEE=y
>>>> +CONFIG_OPTEE=y
>>>> +CONFIG_EFI_MM_COMM_TEE=y
>>>
>>> According to lib/efi_loader/Makefile:
>>>
>>> ifeq ($(CONFIG_EFI_MM_COMM_TEE),y)
>>> obj-y += efi_variable_tee.o
>>> else
>>> obj-y += efi_variable.o
>>> obj-$(CONFIG_EFI_VARIABLES_PRESEED) += efi_var_seed.o endif
>>>
>>> The `CONFIG_EFI_MM_COMM_TEE` conflicts with
>>> `CONFIG_EFI_VARIABLES_PRESEED`, so you have to choose one.
>>>
>>
>> Right. When we switch this, we also need to switch the secure boot setup
>> procedure so that the result remains securely booted.
>>
>> Jan
> Do you want to do those adjustments within this patch series or
> do it separately?

Well, if we leave out enabling CONFIG_EFI_MM_COMM_TEE from this series,
would that leave something testable / minimally useful behind? If not,
we need the transition to secure boot keys in RPMB already in this series.

Jan

-- 
Siemens AG, Technology
Competence Center Embedded Linux