Re: [isar-cip-core][PATCH 3/8] Include optee into u-boot

[Jan Kiszka <jan.kiszka@siemens.com>]

On 10.11.22 12:01, Schultschik, Sven (DI PA DCP R&D 2) wrote:
>>>
>>
>> Can you summarize again here what options we have now? It seems we need a
>> proper RPMB emulation rather sooner than later.
>>
> 
> Option 1:
> - Keep it as it is
> - CONFIG_BOOTDELAY=5
> - manually set PK, KEK, db on every boot
> 
> Option 2:
> - Write a small u-boot script für qemu u-boot (never done this before)
> - This script runs on every boot
> - This script initializes secure efi env with PK, KEK, db

You can basically put the commands you would manually execute into
CONFIG_BOOTCOMMAND. We already have a custom string there for secure
boot, see
https://gitlab.com/cip-project/cip-core/isar-cip-core/-/blob/master/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl.
Would likely qualify for separating this "special" extension for the
secure-boot.cfg.tmpl baseline.

> 
> Option 3: 
> - Proper RPMB emulation, which takes to long for now

Yes, likely. At least I did step 0.1, registered with jedec.org and
fetched the spec. It's not done over an afternoon, but possibly also
only within few weeks (with some experience with QEMU).

Jan

-- 
Siemens AG, Technology
Competence Center Embedded Linux