AW: [isar-cip-core][PATCH 3/8] Include optee into u-boot

From: "Schultschik, Sven" <sven.schultschik@siemens.com>
To: "Kiszka, Jan" <jan.kiszka@siemens.com>,
	"baocheng.su@siemens.com" <baocheng.su@siemens.com>,
	"cip-dev@lists.cip-project.org" <cip-dev@lists.cip-project.org>
Subject: AW: [isar-cip-core][PATCH 3/8] Include optee into u-boot
Date: Mon, 7 Nov 2022 16:57:25 +0000	[thread overview]
Message-ID: <PAXPR10MB50370BA1C33D4D3C49939A5A903C9@PAXPR10MB5037.EURPRD10.PROD.OUTLOOK.COM> (raw)
In-Reply-To: <4e5a1133-8b45-2d45-101c-b059a89d6251@siemens.com>

[-- Attachment #1: Type: text/plain, Size: 1147 bytes --]

> >>>
> >>
> >> Right. When we switch this, we also need to switch the secure boot
> >> setup procedure so that the result remains securely booted.
> >>
> >> Jan
> > Do you want to do those adjustments within this patch series or do it
> > separately?
>
> Well, if we leave out enabling CONFIG_EFI_MM_COMM_TEE from this series,
> would that leave something testable / minimally useful behind? If not, we 
> need
> the transition to secure boot keys in RPMB already in this series.
>

If we go fully on the optee rpmb solution only with the manual test patch 8/8

Else we would need to provide a
- PK, KEK and db
- a u-boot script which does on every boot such things
fatload virtio 1:1 40000000 PK.auth
setenv -e -nv -bs -rt -at -i 40000000:$filesize PK
fatload virtio 1:1 40000000 KEK.auth
setenv -e -nv -bs -rt -at -i 40000000:$filesize KEK
fatload virtio 1:1 40000000 db.auth
setenv -e -nv -bs -rt -at -i 40000000:$filesize db

Why?
The secure UEFI environment is not persistent in the patched u-boot qemu 
setting. The RPMB in u-boot is emulated as struct in memory.

Jan we could make a small talk if you want to discuss further steps.

Sven

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 14944 bytes --]