[isar-cip-core][PATCH 0/7] Provide measured boot via fTPM for arm64, early deploy EFI keys

[Jan Kiszka <jan.kiszka@siemens.com>]

Due to some deficits in U-Boot, the fTPM was not recognized and, thus,
its PCRs for measurements were not fed. This led to the disk encryption
key we are storing in the TPM not being sealed properly. Existing
deployments were most likely not affected by this when they locked down
U-Boot to only boot in secure mode (like we did and continue to do).

After fixing this, we are confronted with a practical problem: The QEMU
target for arm64 is set up without pre-deployed UEFI keys. When we now,
with working measurements, switch to secure boot after the initial disk
encryption, unsealing the key will no longer work.

For this but possibly also for other scenarios, the series adds an
initramfs hook which tries to deploy the secure boot keys if the target
is in non-secure mode and no other keys are deployed yet.

With all that in place, we change the policy of the disk encryption
hook to only perform its task when the device is securely booted. If
this should break valid downstream scenarios, we may make it opt-out
later on, but so far none are imaginable.

Jan

Jan Kiszka (7):
  secure-boot-efi-keys: Add recipe to create EFI keys
  cip-initramfs-functions: Add secure_boot_enabled helper
  cip-core-initramfs: Automatically deploy secure boot keys on first
    boot
  u-boot: Add patches to enable measured boot with fTPM
  u-boot: Refactor ftpm-stmm.cfg to enable measured boot for all
  u-boot: Drop obsolete config workaround
  initramfs-crypt-hook: Prevent encryption without secure boot

 ...ement-Fix-compilation-for-non-sandbo.patch |  43 +++++
 ...-out-service-enumeration-and-binding.patch |  95 +++++++++++
 ...pport-for-enumerating-services-that-.patch | 155 ++++++++++++++++++
 ...-warn-about-TEE_ERROR_STORAGE_NOT_AV.patch |  33 ++++
 ...to-optee-after-a-successful-mmc_init.patch |  41 +++++
 ...-MMC-Device-not-found-a-debug-output.patch |  50 ++++++
 recipes-bsp/u-boot/files/ftpm-stmm.cfg        |   7 +-
 recipes-bsp/u-boot/files/qemu-extra.cfg       |   2 +
 recipes-bsp/u-boot/files/secure-boot.cfg      |   2 -
 recipes-bsp/u-boot/files/ti-extra.cfg         |   8 +-
 recipes-bsp/u-boot/u-boot-common-2026.01.inc  |   6 +
 .../single-key-to-efi-keys_0.1.bb             |  41 +++++
 .../cip-core-initramfs/cip-core-initramfs.bb  |   1 +
 .../files/cip-initramfs-functions             |  16 ++
 .../files/local-top-complete                  |   4 +
 .../initramfs-sbkeys-hook/files/hook          |  16 ++
 .../initramfs-sbkeys-hook/files/local-top     |  34 ++++
 .../initramfs-sbkeys-hook/files/mount-stub    |  13 ++
 .../initramfs-sbkeys-hook_0.1.bb              |  32 ++++
 19 files changed, 589 insertions(+), 10 deletions(-)
 create mode 100644 recipes-bsp/u-boot/files/0001-test-boot-measurement-Fix-compilation-for-non-sandbo.patch
 create mode 100644 recipes-bsp/u-boot/files/0002-tee-optee-Factor-out-service-enumeration-and-binding.patch
 create mode 100644 recipes-bsp/u-boot/files/0003-tee-optee-Add-support-for-enumerating-services-that-.patch
 create mode 100644 recipes-bsp/u-boot/files/0004-tee-optee-Do-not-warn-about-TEE_ERROR_STORAGE_NOT_AV.patch
 create mode 100644 recipes-bsp/u-boot/files/0005-mmc-Call-back-to-optee-after-a-successful-mmc_init.patch
 create mode 100644 recipes-bsp/u-boot/files/0006-mmc-Make-MMC-Device-not-found-a-debug-output.patch
 create mode 100644 recipes-devtools/secure-boot-efi-keys/single-key-to-efi-keys_0.1.bb
 create mode 100644 recipes-initramfs/initramfs-sbkeys-hook/files/hook
 create mode 100644 recipes-initramfs/initramfs-sbkeys-hook/files/local-top
 create mode 100755 recipes-initramfs/initramfs-sbkeys-hook/files/mount-stub
 create mode 100644 recipes-initramfs/initramfs-sbkeys-hook/initramfs-sbkeys-hook_0.1.bb

-- 
2.47.3