AW: [isar-cip-core][PATCH 3/8] Include optee into u-boot

From: "Schultschik, Sven" <sven.schultschik@siemens.com>
To: "Kiszka, Jan" <jan.kiszka@siemens.com>,
	"baocheng.su@siemens.com" <baocheng.su@siemens.com>,
	"cip-dev@lists.cip-project.org" <cip-dev@lists.cip-project.org>
Subject: AW: [isar-cip-core][PATCH 3/8] Include optee into u-boot
Date: Wed, 26 Oct 2022 15:27:38 +0000	[thread overview]
Message-ID: <PAXPR10MB5037772EDDB7F8F29463E6DB90309@PAXPR10MB5037.EURPRD10.PROD.OUTLOOK.COM> (raw)
In-Reply-To: <d8d40615-4e43-86ad-c947-cd3c0827e389@siemens.com>

[-- Attachment #1: Type: text/plain, Size: 2458 bytes --]


> -----Ursprüngliche Nachricht-----
> Von: Kiszka, Jan (T CED) <jan.kiszka@siemens.com>
> Gesendet: Mittwoch, 26. Oktober 2022 10:53
> An: Su, Bao Cheng (DI FA CTR IPC CN PRC4) <baocheng.su@siemens.com>;
> Schultschik, Sven (DI PA DCP R&D 2) <sven.schultschik@siemens.com>; cip-
> dev@lists.cip-project.org
> Betreff: Re: [isar-cip-core][PATCH 3/8] Include optee into u-boot
> 
> On 26.10.22 09:36, Su, Bao Cheng wrote:
> > On Mon, 2022-10-24 at 14:27 +0200, sven.schultschik@siemens.com wrote:
> >> From: Sven Schultschik <sven.schultschik@siemens.com>
> >>
> >> Optee is part of u-boot In the secureboot scenario to use optee and RPMB as
> secure storage.
> >>
> >> Signed-off-by: Sven Schultschik <sven.schultschik@siemens.com>
> >> ---
> >>  recipes-bsp/u-boot/files/secure-boot.cfg.tmpl | 7 +++++++
> >>  recipes-bsp/u-boot/u-boot-qemu-common.inc     | 2 ++
> >>  2 files changed, 9 insertions(+)
> >>
> >> diff --git a/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl
> >> b/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl
> >> index 956dcbfed..8e6428238 100644
> >> --- a/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl
> >> +++ b/recipes-bsp/u-boot/files/secure-boot.cfg.tmpl
> >> @@ -4,3 +4,10 @@ CONFIG_USE_BOOTCOMMAND=y
> >>  CONFIG_BOOTCOMMAND="setenv scan_dev_for_boot 'if test -e ${devtype}
> ${devnum}:${distro_bootpart} efi/boot/boot${EFI_ARCH}.efi; then load
> ${devtype} ${devnum}:${distro_bootpart} ${kernel_addr_r}
> efi/boot/boot${EFI_ARCH}.efi; bootefi ${kernel_addr_r} ${fdtcontroladdr}; fi';
> run distro_bootcmd; echo 'EFI Boot failed!'; sleep 1000; reset"
> >>  CONFIG_EFI_VARIABLES_PRESEED=y
> >>  CONFIG_EFI_SECURE_BOOT=y
> >> +### OPTEE config
> >> +CONFIG_CMD_OPTEE_RPMB=y
> >> +CONFIG_MMC=y
> >> +CONFIG_SUPPORT_EMMC_RPMB=y
> >> +CONFIG_TEE=y
> >> +CONFIG_OPTEE=y
> >> +CONFIG_EFI_MM_COMM_TEE=y
> >
> > According to lib/efi_loader/Makefile:
> >
> > ifeq ($(CONFIG_EFI_MM_COMM_TEE),y)
> > obj-y += efi_variable_tee.o
> > else
> > obj-y += efi_variable.o
> > obj-$(CONFIG_EFI_VARIABLES_PRESEED) += efi_var_seed.o endif
> >
> > The `CONFIG_EFI_MM_COMM_TEE` conflicts with
> > `CONFIG_EFI_VARIABLES_PRESEED`, so you have to choose one.
> >
> 
> Right. When we switch this, we also need to switch the secure boot setup
> procedure so that the result remains securely booted.
> 
> Jan
Do you want to do those adjustments within this patch series or
do it separately?

Sven

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 14944 bytes --]